Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-13183: Hotech Otello: Malicious Code Can Run on Visitor's Browser

CVE-2025-13183 · published 10 months ago

Summary

A security issue in Hotech Otello software can allow hackers to inject malicious code into your website, which can then run on visitors' browsers, potentially leading to unauthorized actions or data theft. This affects Otello versions 2.4.0 to 2.4.4. To protect your users, update Otello to version 2.4.4 or later.

Original advisory text

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS. This issue affects Otello: from 2.4.0 be...

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS.

This issue affects Otello: from 2.4.0 before 2.4.4.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published23 Dec 2025

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-13183 · NVD

Track software like this

Free during beta