{"id":"CVE-2025-7920","aliases":["EUVD-2025-22056","GHSA-v869-2g6q-4fwq"],"status":"published","title":"Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting","description":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00343,"percentile":0.28029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-21T06:59:23Z","modified":"2026-06-17T10:05:58Z","products":[{"vendor":"simopro technology","product":"winmatrix3 web package"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10262-2fcb6-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10267-775be-2.html","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7920"},{"url":"https://github.com/advisories/GHSA-v869-2g6q-4fwq"}],"sources":{"cve":[{"id":"CVE-2025-7920","title":"Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting","description":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.","status":"published","published":"2025-07-21T06:59:23.11Z","modified":"2025-07-21T15:25:35.826Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-22056","description":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.","status":"published","published":"2025-07-21T06:59:23Z","modified":"2025-07-21T15:25:35Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:06.504899Z"}],"ghsa":[{"id":"GHSA-v869-2g6q-4fwq","title":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting...","description":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.","status":"published","published":"2025-07-21T09:33:26Z","modified":"2025-07-21T09:33:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:03:04.468862Z"}],"nvd":[{"id":"CVE-2025-7920","description":"WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.","status":"published","published":"2025-07-21T07:15:25.137Z","modified":"2026-06-17T10:05:58.263Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:19.382856Z"}]}}