CVE-2025-20049

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-20059.8The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads fieCVE-2025-200506.7Uncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escCVE-2025-200516.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching andCVE-2025-200527.3Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via locaCVE-2025-200537.2Improper buffer restrictions for some Intel(R) Xeon(R) Processor firmware with SGX enabled may allow a privileged user to potentially enableCVE-2025-200546.5Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaCVE-2025-200559.8OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can aCVE-2025-200564.4Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of prCVE-2025-200573.5Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to pCVE-2025-200587.5When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilizCVE-2025-200599.1Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java PoCVE-2025-20068.8The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in
CVE-2025-20049: Medium severity, CVSS 5.8 | Vulnix