CVE-2025-4075

Summary

CVE-2025-4075 is a recently disclosed vulnerability affecting VMSMan up to version 20250416. This issue, which has been rated as problematic, impacts an unspecified functionality within the /login.php file. Maliciously crafted Email input, specifically "<script>alert(1)</script>", can trigger a cross-site scripting (XSS) attack. The vulnerability can be exploited remotely, meaning an attacker does not need to have prior access to the affected system. The exploit for this flaw has been made public, increasing the risk of widespread exploitation. Despite early notification, the vendor has not responded to the disclosure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.