CVE-2025-2141

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-214108.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2025-214118.8Windows Telephony Service Remote Code Execution VulnerabilityCVE-2025-214138.8Windows Telephony Service Remote Code Execution VulnerabilityCVE-2025-214147.0Windows Core Messaging Elevation of Privileges VulnerabilityCVE-2025-214158.8Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.CVE-2025-214168.8Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.CVE-2025-214178.8Windows Telephony Service Remote Code Execution VulnerabilityCVE-2025-214187.8Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2025-214197.1Windows Setup Files Cleanup Elevation of Privilege VulnerabilityCVE-2025-214207.8Windows Disk Cleanup Tool Elevation of Privilege VulnerabilityCVE-2025-214217.8Memory corruption while processing escape code in API.CVE-2025-214227.8Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
CVE-2025-2141: Medium severity, CVSS 6.1 | Vulnix