{"id":"CVE-2025-28245","aliases":["EUVD-2025-21050","GHSA-mx92-jfpg-3r7q"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers...","description":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00311,"percentile":0.24186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-10T00:00:00Z","modified":"2026-06-17T09:04:41Z","products":[{"vendor":"alteryx","product":"alteryx_server"}],"references":[{"url":"https://alteryx.com","tags":["Product"]},{"url":"https://gist.github.com/DylanGrl/5e0ac3924f4d939e9c1ebb8632f2851b","tags":["exploit","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-28245"},{"url":"https://github.com/advisories/GHSA-mx92-jfpg-3r7q"}],"sources":{"cve":[{"id":"CVE-2025-28245","description":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.","status":"published","published":"2025-07-10T00:00:00Z","modified":"2025-07-11T17:56:41.606Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:50.176138Z"}],"euvd":[{"id":"EUVD-2025-21050","description":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.","status":"published","published":"2025-07-10T00:00:00Z","modified":"2025-07-11T17:56:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:09.102762Z"}],"ghsa":[{"id":"GHSA-mx92-jfpg-3r7q","title":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers...","description":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.","status":"published","published":"2025-07-10T21:31:52Z","modified":"2025-07-11T18:30:33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:59.952815Z"}],"nvd":[{"id":"CVE-2025-28245","description":"Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.","status":"published","published":"2025-07-10T19:15:24.677Z","modified":"2026-06-17T09:04:41.27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:18.285862Z"}]}}