CVE-2025-40901
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags, leading to potential phishing attacks.
Risk Assessment
An attacker could exploit this vulnerability to conduct phishing attacks and redirects, potentially leading to user data disclosure.
Recommendation
It is recommended to review and improve input validation in the Credentials Manager and implement additional security measures to minimize the risk of attacks.
Original NVD description (English source)
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected identity, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.