CVE-2025-41228CWE-79

VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

Medium · published May 20, 2025

CVSS v3.1
4.3
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00895 · 59.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-20T14:24Z
EPSS history
Timeline
  • 20 MAY 14:24Z
    VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
    cvelistv5