medium5.4
CVE-2025-13902
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated…
Impact
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Schneider-Electric | Modicon M258 Firmware | All versions |
| Schneider-Electric | Modicon Lmc058 Firmware | All versions |
| Schneider-Electric | Modicon M251 Firmware | before 5.4.13.12 |
| Schneider-Electric | Modicon M241 Firmware | before 5.4.13.12 |