PT-2026-1700 · Unknown · Webconsole

Ncia Researchers · Publicado 2026-01-07 · Atualizado 2026-02-02 · CVE-2025-12776

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WebConsole (affected versions not specified)

Description The Report Builder component stores user input directly into a web page and displays it to other users, potentially leading to a Cross-Site Scripting (XSS) attack. The scripts are executed when a report is modified by a user with edit permissions, not when the report is run by end users. The WebConsole package is end of life and is no longer maintained. It is strongly recommended to avoid installing or using it in production environments. If used, it must be deployed within a fully isolated network with no access to sensitive data or internet connectivity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-12776

Produtos afetados

Webconsole

Referências · 6

• https://t.me/cveNotify/147997 · Publicação no Telegram
• https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009032509456318927 · Publicação no Twitter
• https://t.me/cveNotify/150632 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-12776 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-12776 · Nota de Segurança