CVE-2025-9913CWE-79cross-site-scripting

CVE-2025-9913

Medium · published October 6, 2025

CVSS v3.1
4.5
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-06T11:15Z
Affected products (4)
ProductVersionsFixed in
sick/baggage_analyticsall versions—
sick/logistic_diagnostic_analyticsall versions—
sick/package_analyticsall versions—
sick/tire_analyticsall versions—
References (6)
https://sick.com/psirt · [email protected]https://www.cisa.gov/resources-tools/resources/ics-recommended-practices · [email protected]https://www.first.org/cvss/calculator/3.1 · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json · [email protected]https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf · [email protected]https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · [email protected]
EPSS history
Timeline
  • 06 OCT 06:40Z
    Cross Site Scripting: Session Hijacking
    cvelistv5