An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
References
| Link | Resource |
|---|---|
| https://certvde.com/en/advisories/VDE-2025-018/ |
Configurations
No configuration.
History
No history.
Information
Published : 2025-06-16 10:15
Updated : 2025-11-21 12:15
NVD link : CVE-2025-25264
Mitre link : CVE-2025-25264
CVE.ORG link : CVE-2025-25264
JSON object : View
Products Affected
No product.
CWE
CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains