{"affected":[{"defaultStatus":"unaffected","product":"vtenext","source":"CNA: VulnCheck","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2025-71453","cwes":["CWE-79"],"description":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"}],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},{"score":6.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793824602460,"publishedAt":1793824602460,"references":[{"source":"CNA: VulnCheck","tags":["third-party-advisory","exploit"],"url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"remediation":[],"revision":"8b0f00f81dc21fa04a9396a6c652378312112d2a52cf0e65f3d16dc09dabbb59","sources":[{"modifiedAt":1793824602460,"name":"CNA: VulnCheck","retrievedAt":1793826502470,"url":"https://www.cve.org/CVERecord?id=CVE-2025-71453"}],"ssvc":null,"status":"published","title":"vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList","updatedAt":1793826502470}