CVE-2025-28890

Summary

CVE-2025-28890 is a Cross-site Scripting (XSS) vulnerability affecting NotFound Lightview Plus. The issue, which allows Reflected XSS, stems from improper neutralization of user input during web page generation. This weakness could be exploited by attackers to inject malicious scripts into a web page viewed by other users, potentially leading to unauthorized data access or theft of user credentials. NotFound Lightview Plus versions from n/a through 3.1.3 are believed to be vulnerable. It is crucial that users upgrade to a secure version to prevent potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.