CVE-2025-0643CWE-79cross-site-scripting

CVE-2025-0643

High · published November 20, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

⚡ Stored XSS lurks in Pyxis Signage, ready to exploit any unsuspecting user! Think of it like a sneaky chef who swaps ingredients without anyone noticing — one compromised input can alter the whole dish, making it not just inedible but downright dangerous! 🍽️ An attacker could craft malicious scripts that, when viewed by users, run without their knowledge — imagine them taking control of your digital signage! This could lead to unauthorized data exposure or even defacing your content. It's a potential recipe for chaos!

Put simply

Think of it like a sneaky chef who swaps ingredients without anyone noticing — one compromised input can alter the whole dish, making it not just inedible but downright dangerous! 🍽️ This vulnerability in Pyxis Signage arises from improper handling of user input, allowing attackers to inject malicious scripts that are stored and executed when other users access affected pages.

What to do

An attacker could craft malicious scripts that, when viewed by users, run without their knowledge — imagine them taking control of your digital signage! This could lead to unauthorized data exposure or even defacing your content. It's a potential recipe for chaos! Immediate action is required: ensure to update to the latest version of Pyxis Signage before 31012025, review user input sanitization practices, and implement a Content Security Policy to mitigate risks. Don't delay! You've got this! With these steps, you’ll be on your way to securing your signage! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-20T20:17Z
References (2)
EPSS history
Timeline
  • 20 NOV 13:26Z
    XSS in Narkom Communication Technologies' Pyxis Signage
    cvelistv5