CVE-2025-2709
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 24, 2025
Updated: Mar 27, 2025
CWE ID 122
CWE ID 787
Summary
CVE-2025-2709 is a newly disclosed vulnerability affecting the Yonyou UFIDA ERP-NC 5.0 system. The issue lies in the manipulation of the argument key/redirect in the /login.jsp file, leading to cross-site scripting (XSS). This vulnerability can be exploited remotely, allowing attackers to inject malicious scripts into unsuspecting users' browsers. Despite early disclosure to the vendor, they have yet to respond or issue a patch, leaving potentially vulnerable systems open to attack.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Cisco OpenH264
Affected Vendors
- Cisco