PT-2026-1700 · Unknown · Webconsole

Ncia Researchers · Published 2026-01-07 · Updated 2026-02-02 · CVE-2025-12776

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WebConsole (affected versions not specified)

Description The Report Builder component stores user input directly into a web page and displays it to other users, potentially leading to a Cross-Site Scripting (XSS) attack. The scripts are executed when a report is modified by a user with edit permissions, not when the report is run by end users. The WebConsole package is end of life and is no longer maintained. It is strongly recommended to avoid installing or using it in production environments. If used, it must be deployed within a fully isolated network with no access to sensitive data or internet connectivity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12776

Affected Products

Webconsole

References · 6

• https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12776 · Security Note
• https://t.me/cveNotify/147997 · Telegram Post
• https://twitter.com/CVEnew/status/2009032509456318927 · Twitter Post
• https://t.me/cveNotify/150632 · Telegram Post