CVE-2025-20303
MediumCVSS 5.4Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could inject malicious code into specific pages of the interface.
Risk Assessment
An attacker with at least low privileges could execute arbitrary script code in the context of the interface or access sensitive browser-based information. This could lead to session or user data theft.
Recommendation
Update Cisco ISE and ISE-PIC to a version containing the security fixes. Additionally, restrict low-privileged accounts and educate users about phishing.
Related vulnerabilities
- CVE-2026-111998Critical
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- CVE-2026-110886Critical
The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.
- CVE-2026-110372Critical
The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-109894Critical
The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.
- CVE-2026-111911Critical
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
- CVE-2026-104736Critical
The LearnPress plugin for WordPress in versions up to and including 4.4.10 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value passes through sanitize_text_field(), which does not strip serialized object syntax, is stored in the LearnPress session table, and later fed to unserialize() without an allowed_classes restriction.
- CVE-2026-110653Critical
The LatePoint plugin for WordPress in versions up to and including 5.7.4 is vulnerable to Authentication Bypass via Race Condition in the verifyOTP function. The OTP attempts counter is updated non-atomically without a WHERE attempts < 10 guard and without a row lock, creating a TOCTOU window that lets concurrent requests bypass the 10-attempt lockout.
- CVE-2026-111823Critical
Mage OSS through 0.9.80 (before commit 76c4f46) can proceed with session creation upon encountering an unknown OAuth provider. An unknown OAuth provider is not properly rejected, allowing a session to be created.
- CVE-2026-96620Critical
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls.
- CVE-2026-102608Critical
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user.
Original NVD description (English source)
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS