---
id: CVE-2025-11291
title: >-
  A security flaw has been discovered in ixmaps website2017 up to
  0c71cffa0162186bc057a76766bc97e9f5a3a2d0
summary: >-
  A security flaw has been discovered in ixmaps website2017 up to
  0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of
  the file /map.php of the component HTTP GET Request Handler. Performing
  manipulation of the arg…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
  - CWE-94
published: '2025-10-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11291'
references:
  - url: 'https://github.com/PlsRevert/CVEs/issues/2'
    label: cna@vuldb.com
  - url: 'https://github.com/PlsRevert/CVEs/issues/2#issue-3444474977'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.327172'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.327172'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.661179'
    label: cna@vuldb.com
  - url: 'https://github.com/PlsRevert/CVEs/issues/2'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/PlsRevert/CVEs/issues/2#issue-3444474977'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00344
epssPercentile: 0.2544
ingestedAt: '2026-09-30T23:29:32.416Z'
---

## Overview

A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php of the component HTTP GET Request Handler. Performing manipulation of the argument trid results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.