CVE-2025-20216

MEDIUM Year: 2025
CVSS v3 Score
4.7
Medium
Weakness Type
CWE-74
View all →

Vulnerability Description

A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This vulnerability is due to improper sanitization of input to the web interface. An attacker could exploit this vulnerability by convincing an authenticated user to click a malicious link. A successful exploit could allow the attacker to inject HTML into the browser of an authenticated Cisco Catalyst SD-WAN Manager user.

Related Vulnerabilities

CVE-2018-1474

MEDIUM
CVSS:4.7(Medium)

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit t...

CWE-742018

CVE-2020-15187

MEDIUM
CVSS:4.7(Medium)

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an at...

CWE-742020

CVE-2020-4027

MEDIUM
CVSS:4.7(Medium)

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vuln...

CWE-742020

CVE-2023-30609

MEDIUM
CVSS:4.7(Medium)

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search resu...

CWE-742023

CVE-2024-11956

MEDIUM
CVSS:4.7(Medium)

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanage...

CWE-742024

CVE-2024-28234

MEDIUM
CVSS:4.7(Medium)

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are onl...

CWE-742024