{"id":"CVE-2025-49185","aliases":["EUVD-2025-18185","GHSA-h5pq-x44c-mx4p"],"status":"published","title":"Stored Cross-Site-Script","description":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0031,"percentile":0.24126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-06-12T13:25:42Z","modified":"2026-06-17T09:30:53Z","products":[{"vendor":"sick","product":"field_analytics"},{"vendor":"sick ag","product":"sick field analytics"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Website","Vendor Advisory"]},{"url":"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF","tags":["x_SICK Operating Guidelines","Broken Link"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security","US Government Resource"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator","Not Applicable"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json","tags":["vendor-advisory","x_csaf","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49185"},{"url":"https://github.com/advisories/GHSA-h5pq-x44c-mx4p"}],"sources":{"cve":[{"id":"CVE-2025-49185","title":"Stored Cross-Site-Script","description":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.","status":"published","published":"2025-06-12T13:25:42.718Z","modified":"2025-06-12T13:53:26.633Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18185","description":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.","status":"published","published":"2025-06-12T13:25:42Z","modified":"2025-06-12T13:53:26Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.598995Z"}],"ghsa":[{"id":"GHSA-h5pq-x44c-mx4p","title":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create...","description":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.","status":"published","published":"2025-06-12T15:31:22Z","modified":"2025-06-12T15:31:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2025-49185","description":"The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.","status":"published","published":"2025-06-12T14:15:30.863Z","modified":"2026-06-17T09:30:53.7Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:11.789448Z"}]}}