CVE-2025-56537
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.
Risk Assessment
An attacker can inject malicious code into a virtual network template, which executes in the browser of a user viewing the template, potentially leading to session compromise or unauthorized actions.
Recommendation
Update opennebula to version 7.0 or later. Additionally, restrict permissions to edit virtual network templates to trusted administrators only.
Other vulnerabilities in opennebula
See all- CVE-2026-84165High
A vulnerability related to incorrect access control in OpenNebula (all versions prior to 7.4) allows an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the one.vm.exec function, without proper verification of access permissions. To exploit, it is only necessary to know the virtual machine's identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
- CVE-2025-56536Medium
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.
- CVE-2025-56535Medium
A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.
- CVE-2025-56534Medium
A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS