PT-2025-17601 · Unknown+2 · Xy Chart Plugin+2

Paul Gerste · Published 2025-04-23 · Updated 2025-06-19 · CVE-2025-2703

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description The built-in XY Chart plugin is affected by a DOM XSS issue. A user with Editor permissions can modify a panel to execute arbitrary JavaScript.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-07172

BIT-GRAFANA-2025-2703

CVE-2025-2703

OPENSUSE-SU-2025:15052-1

SUSE-SU-2025:01985-1

SUSE-SU-2025:01987-1

SUSE-SU-2025:01989-1

SUSE-SU-2025:01991-1

SUSE-SU-2025_01987-1

Affected Products

Red Os

Suse

Xy Chart Plugin

References · 68

• 🔥 https://github.com/nollium/CVE-2024-9264 · Exploit
• 🔥 https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit · Exploit
• 🔥 https://github.com/z3k0sec/File-Read-CVE-2024-9264 · Exploit
• 🔥 https://github.com/hex0punk/cont-flood-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2703 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01987-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2025-2703 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15052-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01985-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01991-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07172 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01989-1 · Vendor Advisory
• https://t.me/cvedetector/23590 · Telegram Post
• https://suse.com/security/cve/CVE-2025-3580 · Note