CVE-2025-54760
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
Risk Assessment
An attacker can hijack user sessions, steal credentials, or perform actions on behalf of the victim. This may lead to a breach of confidentiality and integrity of the system.
Recommendation
Update desknet's NEO to the latest version that fixes the vulnerability. Implement additional input validation and sanitization mechanisms.
Other vulnerabilities in desknet's NEO
See all- CVE-2025-58426Medium
desknet's NEO versions V4.0R1.0 to V9.0R2.0 contain a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
- CVE-2025-58079Medium
In desknet's NEO V4.0R1.0 to V9.0R2.0, there is an Improper Protection of Alternate Path (CWE-424) vulnerability in the AppSuite that allows an attacker to create malicious AppSuite applications.
- CVE-2025-55072Medium
In desknet's NEO V2.0R1.0 to V9.0R2.0, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54859Medium
In desknet's NEO V9.0R2.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-24833Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
Original NVD description (English source)
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS