CVE-2025-28097
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Published Mar 28, 2025
Updated: Apr 7, 2025
CWE ID 79
Summary
CVE-2025-28097: A Cross Site Scripting (XSS) vulnerability has been identified in OneNav 1.1.0. An attacker can exploit this issue by injecting malicious scripts into custom headers, potentially gaining unauthorized access to user sessions or stealing sensitive information. Users are urged to update to the latest version of OneNav to mitigate this risk. Failure to do so may result in serious security consequences.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.