PT-2025-47186 · Unknown · Dependency-Track

Published 2025-11-17 · Updated 2025-11-19 · CVE-2025-64758

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.13.6

Description Dependency-Track, an open source Component Analysis platform, contains a weakness in its frontend application. Specifically, versions before 4.13.6 do not properly sanitize HTML when rendering a welcome message on the login page. This allows users with the SYSTEM CONFIGURATION permission (administrators) to execute arbitrary JavaScript for users accessing the login page. The welcome message is configured via HTML and is intended for branding purposes.

Recommendations Update to version 4.13.6 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64758

GHSA-7XVH-C266-CFR5

Affected Products

Dependency-Track

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64758.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64758 · Security Note
• https://osv.dev/vulnerability/GHSA-7xvh-c266-cfr5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64758 · Vendor Advisory
• https://github.com/DependencyTrack/frontend/pull/986 · Note
• https://github.com/DependencyTrack/frontend · Note
• https://github.com/DependencyTrack/frontend/pull/1378 · Note
• https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5 · Note
• https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be · Note
• https://reddit.com/r/VulnMatter/comments/1p0kjng/resumen_diario_de_vulnerabilidades_18112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p1gf2n/resumen_diario_de_vulnerabilidades_19112025 · Reddit Post
• https://t.me/CVEtracker/37525 · Telegram Post
• https://twitter.com/CVEnew/status/1990477795416297982 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ozp1t6/resumen_diario_de_vulnerabilidades_17112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1990490518162182652 · Twitter Post