PT-2026-20947 · Opentext · Opentext Web Site Management Server

Murat Altindis · Publicado 2026-02-19 · Atualizado 2026-02-27 · CVE-2025-9208

Positive Technologies (AI Summary)

CVSS v4.0

7.5

Alta

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:P/AU:N/R:U/V:D/RE:H/U:Red

Name of the Vulnerable Software and Affected Versions OpenText Web Site Management Server versions 16.7.X, 16.8, and 16.8.1

Description A flaw exists in OpenText Web Site Management Server that allows for Stored Cross-site Scripting (XSS). The issue occurs when the download query parameter is removed from a file URL, potentially enabling attackers to execute malicious scripts on the client side. Successful exploitation could lead to compromised user sessions and data. The API endpoint involved is a file URL where the download parameter is processed. The vulnerable parameter is download.

Recommendations Versions 16.7.X should be updated. Versions 16.8 should be updated. Versions 16.8.1 should be updated.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-9208

Produtos afetados

Opentext Web Site Management Server

Referências · 7

• 🔥 https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-9208/README.md · Exploit
• https://t.me/CVEtracker/45195 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-9208 · Nota de Segurança
• https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854844 · Aviso do Fabricante
• https://t.me/cveNotify/152538 · Publicação no Telegram
• https://t.me/cveNotify/153602 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-9208 · Aviso do Fabricante