CVE-2025-0104

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Palo Alto NetworksCloud NGFW—
Palo Alto NetworksExpedition>= 1, < 1.2.100
Palo Alto NetworksPanorama—
Palo Alto NetworksPAN-OS—
Palo Alto NetworksPrisma Access—

References

Timeline

Published
Jan 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-01059.1An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files acceCVE-2025-01065.3A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesyCVE-2025-01079.8An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as tCVE-2025-01089.1An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the managementCVE-2025-01096.9An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attackerCVE-2025-01108.6A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the abilityCVE-2025-01116.5An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to CVE-2025-01126.8A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrCVE-2025-01135.3A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to DockerCVE-2025-01147.5A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attackCVE-2025-01156.8A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attCVE-2025-01166.8A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a s
CVE-2025-0104: Medium severity, CVSS 6.1 | Vulnix