5.4
CVE-2025-26391
- EPSS 0.42%
- Veröffentlicht 18.11.2025 08:53:01
- Zuletzt bearbeitet 24.11.2025 16:31:55
- Quelle psirt@solarwinds.com
- CVE-Watchlists
- Unerledigt
SolarWinds Observability Self-Hosted XSS Vulnerability
SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Solarwinds ≫ Observability Self-hosted Version < 2025.4.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.42% | 0.331 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| psirt@solarwinds.com | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26391
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm