PT-2025-41379 · Progress · Flowmon

Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-10240

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Flowmon versions prior to 12.5.5

Description A flaw exists in the Progress Flowmon web application that allows an attacker to manipulate authenticated users through malicious links. Clicking a crafted link can trigger unintended actions within a user's session, potentially leading to unauthorized operations or data exposure.

Recommendations Update to version 12.5.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10240

Affected Products

Flowmon

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10240 · Security Note
• https://community.progress.com/s/article/Can-CVE-2025-10240-affect-Progress-Flowmon-appliance · Vendor Advisory
• https://twitter.com/CveTodo/status/1976278981612552700 · Twitter Post
• https://twitter.com/CveFindCom/status/1976273778519732701 · Twitter Post
• https://t.me/cveNotify/137962 · Telegram Post
• https://twitter.com/CVEnew/status/1976273406560510063 · Twitter Post