VULNERABILITY INTELLIGENCE

CVE-2025-15562

CVSS score6.1 MEDIUM
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-02-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

Weakness classification

  • 551230f0-3615-47bd-b7cc-93e92e730bbf: CWE-79

Primary references