PT-2026-22915 · Cmc · Cmc

Published 2026-03-04 · Updated 2026-03-05 · CVE-2025-40895

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CMC (affected versions not specified)

Description A stored HTML injection issue exists in the Sensor Map functionality due to inadequate validation of properties on connected Guardians. An authenticated user with administrator privileges on a Guardian connected to a CMC can inject HTML tags by editing the Guardian’s properties. If the Sensor Map functionality is enabled within the CMC, a victim CMC user interacting with the functionality may have the injected HTML render in their browser, potentially leading to phishing or open redirect attacks. Existing input validation and Content Security Policy configurations prevent full cross-site scripting exploitation and direct information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40895

Affected Products

Cmc

References · 4

• https://osv.dev/vulnerability/CVE-2025-40895 · Vendor Advisory
• https://security.nozominetworks.com/NN-2025:17-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40895 · Security Note
• https://t.me/cveNotify/154370 · Telegram Post