# Narkom Pyxis Signage has two flaws, including cross-site scripting

- Date: 2025-11-20
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2025-0643, CVE-2025-0645

NVD published two vulnerabilities in Narkom Pyxis Signage, covering cross-site scripting and a security flaw. The cross-site scripting entry is an improper neutralization of input during web page generation, filed against Narkom Communication and Software Technologies Trade Ltd.

## Sources

- [CVE-2025-0643](https://nvd.nist.gov/vuln/detail/CVE-2025-0643) (NIST NVD)
- [CVE-2025-0645](https://nvd.nist.gov/vuln/detail/CVE-2025-0645) (NIST NVD)
- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0404](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0404)
- [https://www.usom.gov.tr/bildirim/tr-25-0404](https://www.usom.gov.tr/bildirim/tr-25-0404)

Page: https://signagelist.org/incidents/2025-11-narkom-pyxis-signage-has-two-flaws-including/