{"id":"CVE-2025-49193","aliases":["EUVD-2025-18192","GHSA-p883-qggf-j55h"],"status":"published","title":"Missing HTTP Security Headers","description":"The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00325,"percentile":0.25926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-693"],"published":"2025-06-12T14:15:07Z","modified":"2026-06-17T09:30:54Z","products":[{"vendor":"plex","product":"media server"},{"vendor":"sick","product":"baggage_analytics"},{"vendor":"sick","product":"field_analytics"},{"vendor":"sick","product":"logistic_diagnostic_analytics"},{"vendor":"sick","product":"media_server"},{"vendor":"sick","product":"package_analytics"},{"vendor":"sick","product":"tire_analytics"},{"vendor":"sick ag","product":"baggage analytics"},{"vendor":"sick ag","product":"field analytics"},{"vendor":"sick ag","product":"logistic diagnostic analytics"},{"vendor":"sick ag","product":"media server"},{"vendor":"sick ag","product":"package analytics"},{"vendor":"sick ag","product":"tire analytics"}],"references":[{"url":"https://sick.com/psirt","tags":["x_SICK PSIRT Website","Vendor Advisory"]},{"url":"https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF","tags":["x_SICK Operating Guidelines","Broken Link"]},{"url":"https://www.cisa.gov/resources-tools/resources/ics-recommended-practices","tags":["x_ICS-CERT recommended practices on Industrial Security","US Government Resource"]},{"url":"https://www.first.org/cvss/calculator/3.1","tags":["x_CVSS v3.1 Calculator","Not Applicable"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json","tags":["vendor-advisory","x_csaf","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49193"},{"url":"https://github.com/advisories/GHSA-p883-qggf-j55h"}],"sources":{"cve":[{"id":"CVE-2025-49193","title":"Missing HTTP Security Headers","description":"The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).","status":"published","published":"2025-06-12T14:15:07.492Z","modified":"2026-05-13T12:01:55.151Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18192","description":"The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).","status":"published","published":"2025-06-12T14:15:07Z","modified":"2026-05-13T12:01:55Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-p883-qggf-j55h","title":"The application fails to implement several security headers. These headers help increase the...","description":"The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).","status":"published","published":"2025-06-12T15:31:23Z","modified":"2025-06-12T15:31:29Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2025-49193","description":"The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).","status":"published","published":"2025-06-12T15:15:39.433Z","modified":"2026-06-17T09:30:54.603Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:11:11.789448Z"}]}}