NetSight
IP …
medium6.1

CVE-2025-8591

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser.

Impact

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.

Affected products

VendorProductAffected versions
Wso2Api Control Plane
from 4.5.0 before 4.5.0.44
from 4.6.0 before 4.6.0.8
Wso2Api Manager
from 3.1.0 before 3.1.0.355
from 3.2.0 before 3.2.0.459
from 3.2.1 before 3.2.1.78
from 4.0.0 before 4.0.0.380
from 4.1.0 before 4.1.0.243
from 4.2.0 before 4.2.0.183
Wso2Identity Server
from 5.10.0 before 5.10.0.384
from 6.0.0 before 6.0.0.255
from 7.0.0 before 7.0.0.131
from 7.1.0 before 7.1.0.51
Wso2Identity Server As Key Manager
from 5.10.0 before 5.10.0.375
Wso2Open Banking Am
from 2.0.0 before 2.0.0.404
Wso2Open Banking Iam
from 2.0.0 before 2.0.0.424
Wso2Traffic Manager
from 4.5.0 before 4.5.0.42
from 4.6.0 before 4.6.0.7
Wso2Universal Gateway
from 4.5.0 before 4.5.0.42
from 4.6.0 before 4.6.0.7

Weakness classification

CWE-79

References