CVE-2025-20330

MediumCVSS 6.1/10Last modified Oct 1, 2026

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
CiscoCisco Unified Communications Manager IM and Presence Service12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; 12.5(1)SU5; 14SU1; 12.5(1)SU6; 14SU2; 14SU2a; 12.5(1)SU7; 14SU3; 12.5(1)SU8; 15; 15SU1; 14SU4; 12.5(1)SU9; 15SU2

References

Timeline

Published
Sep 3, 2025
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-203315.4A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conducCVE-2025-203324.3A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the confCVE-2025-203339.9A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DCVE-2025-203348.8A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with rCVE-2025-203355.3A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 887CVE-2025-203367.5A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 887CVE-2025-2033710.0A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code oCVE-2025-203386.7A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute aCVE-2025-203395.8A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, rCVE-2025-20349.8A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is CVE-2025-203407.4A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent atCVE-2025-203418.8A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administra
CVE-2025-20330: Medium severity, CVSS 6.1 | Vulnix