CVE-2025-1420CWE-79

XSS in Proget MDM

Low · published May 21, 2025

CVSS v4.0
2.4
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.

This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

The record
Technical detail
CVSS v4.0
2.4 · LOW
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-21T13:04Z
EPSS history
Timeline
  • 21 MAY 13:04Z
    XSS in Proget MDM
    cvelistv5