VULNERABILITY INTELLIGENCE
CVE-2025-0423
EPSS probability0.50%
CISA KEVNot currently listed
Published2025-02-18
Last modified2026-06-17
Description
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.
Weakness classification
- vulnerability@ncsc.ch: CWE-20