CVE-2025-22997

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-1.mdBroken Link, Exploit
https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-1.mdBroken Link, Exploit

Timeline

Published: Jan 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-23005.5Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability. This issue affects Hitachi CVE-2025-230016.1A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.CVE-2025-230069.8Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and CVE-2025-230075.5A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentia CVE-2025-230087.2An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker CVE-2025-230097.2A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an ar CVE-2025-23014.4Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Ide CVE-2025-230107.2An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client whic CVE-2025-230118.8Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a CVE-2025-230127.5Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by m CVE-2025-230137.3In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (P CVE-2025-230158.8Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privil