{"affected":[{"defaultStatus":"affected","product":"IdentityIQ","source":"CNA: SailPoint","vendor":"SailPoint Technologies","versions":[{"status":"affected","version":"8.5","versionType":"semver"},{"lessThan":"8.4p4","status":"affected","version":"8.4","versionType":"semver"},{"lessThanOrEqual":"8.3p5","status":"affected","version":"8.3","versionType":"semver"}]}],"cveId":"CVE-2025-10280","cwes":["CWE-79"],"description":"IdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\npath that will set the Content-Type to HTML allowing a requesting browser to\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS).","epss":{"date":"2026-11-03","percentile":0.12299,"score":0.00218},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: SailPoint","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793742767790,"publishedAt":1762187756241,"references":[{"source":"CNA: SailPoint","tags":[],"url":"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280"}],"remediation":[],"revision":"5f609e9d47366cbb91a12707d2a1500ed8442413f2d423da45bf73cd679ecb36","sources":[{"modifiedAt":1793742767790,"name":"CNA: SailPoint","retrievedAt":1793744128353,"url":"https://www.cve.org/CVERecord?id=CVE-2025-10280"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793747322573,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-10280"}],"ssvc":{"assessedAt":1762232116675,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Incorrect Content Type Cross-Site Scripting Vulnerability","updatedAt":1793747322573}