CVE-2025-40902— HTML injection in Users in Guardian/CMC before 26.1.0

HTML injection in Users in Guardian/CMC before 26.1.0

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a group containing the affected user, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Nozomi Networks CMC和Nozomi Networks Guardian 跨站脚本漏洞

Nozomi Networks CMC和Nozomi Networks Guardian都是美国Nozomi Networks公司的产品。Nozomi Networks CMC是一款网络管理平台。Nozomi Networks Guardian是一款防护软件。 Nozomi Networks CMC和Nozomi Networks Guardian存在跨站脚本漏洞，该漏洞源于对输入参数验证不当导致的存储型HTML注入问题，允许具有管理权限的认证用户创建用户名包含HTML标签的恶意用户，当受害者尝试删除包含

N/A

N/A