{"id":"CVE-2025-3020","aliases":["EUVD-2025-13563","GHSA-wj33-6r5j-2626"],"status":"published","title":"Wiesemann \u0026 Theis: Multiple W\u0026T Products are vulnerable to cross-site-scripting","description":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00289,"percentile":0.21672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-05-06T08:01:58Z","modified":"2026-06-17T09:19:02Z","products":[{"vendor":"wiesemann \u0026 theis","product":"erp-gateway 12x digital input, 6x digital relais"},{"vendor":"wiesemann \u0026 theis","product":"erp-gateway 2x digital input, 2x digital output"},{"vendor":"wiesemann \u0026 theis","product":"erp-gateway 2x digital poe"},{"vendor":"wiesemann \u0026 theis","product":"web-alarm 6x6 digitalweb-alarm 6x6 digital"},{"vendor":"wiesemann \u0026 theis","product":"web-count 6x digital"},{"vendor":"wiesemann \u0026 theis","product":"web-graph air quality"},{"vendor":"wiesemann \u0026 theis","product":"web-io 12x digital input, 6x digital relais"},{"vendor":"wiesemann \u0026 theis","product":"web-io analog-in/out 2x 0/4..20ma poe"},{"vendor":"wiesemann \u0026 theis","product":"web-io digital 12xin, 12xout"},{"vendor":"wiesemann \u0026 theis","product":"web-io digital 12xin, 12xout, 1xrs232"},{"vendor":"wiesemann \u0026 theis","product":"web-io digital 2xin, 2xout"},{"vendor":"wiesemann \u0026 theis","product":"web-io digital logger 6xin, 6xout"},{"vendor":"wiesemann \u0026 theis","product":"web-thermo-hygrobarograph"},{"vendor":"wiesemann \u0026 theis","product":"web-thermo-hygrograph"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph 2x"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph 8x"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph ntc"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph ntc poe"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph pt100 / pt1000"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph pt100 / pt1000 poe"},{"vendor":"wiesemann \u0026 theis","product":"web-thermograph relais"}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2025-032"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3020"},{"url":"https://github.com/advisories/GHSA-wj33-6r5j-2626"}],"sources":{"cve":[{"id":"CVE-2025-3020","title":"Wiesemann \u0026 Theis: Multiple W\u0026T Products are vulnerable to cross-site-scripting","description":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.","status":"published","published":"2025-05-06T08:01:58.965Z","modified":"2025-05-06T13:52:19.548Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-13563","description":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.","status":"published","published":"2025-05-06T08:01:58Z","modified":"2025-05-06T13:52:19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:54.858112Z"}],"ghsa":[{"id":"GHSA-wj33-6r5j-2626","title":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload...","description":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.","status":"published","published":"2025-05-06T09:31:31Z","modified":"2025-05-06T09:31:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:08.502889Z"}],"nvd":[{"id":"CVE-2025-3020","description":"An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.","status":"published","published":"2025-05-06T08:15:16.397Z","modified":"2026-06-17T09:19:02.18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}