CVE-2025-7799 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.This issue affects e-Taxpayer Accounting Website: through 07082025.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Zirve Information Technologies Inc.	E-taxpayer Accounting Website

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.usom.gov.tr/bildirim/tr-26-0019

History

Tue, 10 Feb 2026 12:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zirve Information Technologies Inc. Zirve Information Technologies Inc. e-taxpayer Accounting Website
Vendors & Products		Zirve Information Technologies Inc. Zirve Information Technologies Inc. e-taxpayer Accounting Website

Mon, 09 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Feb 2026 08:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.This issue affects e-Taxpayer Accounting Website: through 07082025.
Title		Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website
Weaknesses		CWE-79
References		https://www.usom.gov.tr/bildirim/tr-26-0019
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2026-02-09T08:11:41.873Z

Updated: 2026-02-09T15:16:54.373Z

Reserved: 2025-07-18T08:54:35.467Z

Link: CVE-2025-7799

Vulnrichment

Updated: 2026-02-09T15:16:48.846Z

NVD

Status : Awaiting Analysis

Published: 2026-02-09T09:16:21.643

Modified: 2026-02-09T16:08:35.290

Link: CVE-2025-7799

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7799", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-07-18T08:54:35.467Z", "datePublished": "2026-02-09T08:11:41.873Z", "dateUpdated": "2026-02-09T15:16:54.373Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "e-Taxpayer Accounting Website", "vendor": "Zirve Information Technologies Inc.", "versions": [{"lessThanOrEqual": "07082025", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "\u00c7etin B\u0130N\u0130C\u0130"}], "datePublic": "2026-02-09T08:04:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.<p>This issue affects e-Taxpayer Accounting Website: through 07082025.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.This issue affects e-Taxpayer Accounting Website: through 07082025."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-02-09T08:11:41.873Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-26-0019"}], "source": {"advisory": "TR-26-0019", "defect": ["TR-26-0019"], "discovery": "UNKNOWN"}, "title": "Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:16:35.296837Z", "id": "CVE-2025-7799", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:16:54.373Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7799", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:16:35.296837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:16:48.846Z"}}], "cna": {"title": "Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website", "source": {"defect": ["TR-26-0019"], "advisory": "TR-26-0019", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "\u00c7etin B\u0130N\u0130C\u0130"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zirve Information Technologies Inc.", "product": "e-Taxpayer Accounting Website", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "07082025"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-09T08:04:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-26-0019"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.This issue affects e-Taxpayer Accounting Website: through 07082025.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS.<p>This issue affects e-Taxpayer Accounting Website: through 07082025.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-02-09T08:11:41.873Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7799", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:16:54.373Z", "dateReserved": "2025-07-18T08:54:35.467Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-02-09T08:11:41.873Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}