PT-2025-52220 · Redports · Redports

Stefano Libero · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-40892

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description A Stored Cross-Site Scripting issue exists in the Reports functionality because of inadequate input validation. An authenticated user possessing report privileges can create a malicious report containing a JavaScript payload, or a victim can be tricked into importing a malicious report template. When a victim views or imports the report, the XSS executes within their browser, potentially enabling an attacker to perform unauthorized actions as the victim, including modifying application data, disrupting application availability, and accessing limited sensitive information. The vulnerability involves improper validation of an input parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40892

Affected Products

Redports

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-40892 · Security Note
• https://security.nozominetworks.com/NN-2025:13-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40892 · Vendor Advisory
• https://twitter.com/CVEnew/status/2001728073008640229 · Twitter Post
• https://t.me/CVEtracker/40149 · Telegram Post
• https://t.me/cveNotify/146193 · Telegram Post
• https://twitter.com/TheHackerWire/status/2001658544844894553 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-827968.html · Note