PT-2025-52221 · Unknown · Asset List

Stefano Libero · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-40893

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asset List (affected versions not specified)

Description A Stored HTML Injection issue exists in the Asset List functionality because of inadequate validation of network traffic data. An unauthenticated attacker can send crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the Asset List and similar functions, the injected HTML renders in their browser, potentially enabling phishing and open redirect attacks. Existing input validation and Content Security Policy configurations prevent full Cross-Site Scripting (XSS) exploitation and direct information disclosure. The vulnerability involves improper validation of network traffic data, allowing for the injection of HTML tags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40893

Affected Products

Asset List

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40893 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40893 · Vendor Advisory
• https://security.nozominetworks.com/NN-2025:14-01 · Vendor Advisory
• https://twitter.com/CVEnew/status/2001728071536443522 · Twitter Post
• https://t.me/cveNotify/146194 · Telegram Post
• https://t.me/CVEtracker/40150 · Telegram Post