PT-2025-44786 · Sailpoint · Identityiq

Published 2025-11-03 · Updated 2025-11-12 · CVE-2025-10280

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IdentityIQ versions 8.5 IdentityIQ versions 8.4 through 8.4p3 IdentityIQ versions 8.3 through 8.3p5 versions prior to 8.3p6

Description The software allows certain web services providing non-HTML content to be accessed through a URL that incorrectly sets the Content-Type to HTML. This can lead to a requesting browser interpreting content that is not properly escaped, potentially resulting in Cross-Site Scripting (XSS).

Recommendations Update IdentityIQ to version 8.5p4 or later. Update IdentityIQ to version 8.4p4 or later. Update IdentityIQ to version 8.3p6 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10280

Affected Products

Identityiq

References · 5

• https://osv.dev/vulnerability/CVE-2025-10280 · Vendor Advisory
• https://sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10280 · Security Note
• https://t.me/CVEtracker/36435 · Telegram Post
• https://t.me/cveNotify/142540 · Telegram Post