PT-2025-48036 · Unknown · Idashboards

Published 2025-11-25 · Updated 2025-11-30 · CVE-2025-40890

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dashboards (affected versions not specified)

Description A Stored Cross-Site Scripting issue exists in the Dashboards functionality because of inadequate validation of an input parameter. An authenticated, low-privilege user can create a malicious dashboard with a JavaScript payload and share it with other users, or a user can be tricked into importing a malicious dashboard template. When a user views or imports the dashboard, the JavaScript executes in their browser, potentially allowing an attacker to perform unauthorized actions as the user, including modifying application data, disrupting application availability, and accessing limited sensitive information. The attack involves crafting a malicious dashboard containing a JavaScript payload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40890

Affected Products

Idashboards

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40890 · Security Note
• https://twitter.com/VulmonFeeds/status/1993360933930897807 · Twitter Post
• https://twitter.com/CVEnew/status/1993345222013821391 · Twitter Post
• https://t.me/cveNotify/143969 · Telegram Post
• https://security.nozominetworks.com/NN-2025:11-01 · Note
• https://twitter.com/cracbot/status/1995085458108473789 · Twitter Post