CVE-2025-8591
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the application, which fails to properly encode user-supplied input from a URL parameter before reflecting it back to the browser. This allows an attacker to inject malicious script into the served page.
Risk Assessment
An attacker can redirect the user to a malicious website, modify the application's UI, or retrieve information from the browser. The risk is mitigated by httpOnly flags on session cookies, preventing session hijacking.
Recommendation
Implement proper output encoding for all user-supplied data reflected in HTTP responses. Additionally, consider using Content Security Policy (CSP) headers to provide an extra layer of defense against XSS attacks.
Original NVD description (English source)
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.