CVE-2025-25018

MediumCVSS 5.4/10Last modified Oct 8, 2026

Description

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ElasticKibana>= 7.0.0, <= 7.17.29; >= 8.0.0, <= 8.18.7; >= 8.19.0, <= 8.19.4; >= 9.0.0, <= 9.0.7; >= 9.1.0, <= 9.1.4

References

Timeline

Published
Oct 10, 2025
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-250196.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session aCVE-2025-25027.8An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250206.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated CVE-2025-250217.2IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execCVE-2025-250228.8IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticateCVE-2025-250234.9IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.CVE-2025-250255.3IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnedCVE-2025-250264.3IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.CVE-2025-250296.5IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.CVE-2025-25037.1An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file CVE-2025-250327.5IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user toCVE-2025-250349.3A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper vali
CVE-2025-25018: Medium severity, CVSS 5.4 | Vulnix