CVE-2025-40642CWE-79cross-site-scripting
CVE-2025-40642
published September 8, 2025
What it is
Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search.
The record
Technical detail
- CVSS
- 5.1 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00515 · 43.0th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2025-09-08T16:15Z
References (1)
EPSS history
Timeline