PT-2025-19715 · Unknown · Output Messenger

Published 2025-05-05 · Updated 2025-05-15 · CVE-2025-27921

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Output Messenger versions prior to 2.0.63

Description A reflected cross-site scripting (XSS) issue was discovered, where unsanitized input could be injected into the web application’s response. This occurs when user-controlled input is reflected back into the browser without proper sanitization or encoding.

Recommendations For versions prior to 2.0.63, update to version 2.0.63 or later to resolve the issue. As a temporary workaround, consider implementing proper input sanitization and encoding to prevent user-controlled input from being injected into the web application’s response.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27921

Affected Products

Output Messenger

References · 11

• https://outputmessenger.com/cve-2025-27921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27921 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27921 · Vendor Advisory
• https://t.me/aptreports/18538 · Telegram Post
• https://twitter.com/manan/status/1922808294436925785 · Twitter Post
• https://twitter.com/CVEnew/status/1919419625172775214 · Twitter Post
• https://t.me/aptreports/18535 · Telegram Post
• https://t.me/true_secator/7027 · Telegram Post
• https://srimax.com/products-2/output-messenger · Note
• https://t.me/cvedetector/24474 · Telegram Post
• https://twitter.com/fletch_ai/status/1922245502789419479 · Twitter Post