CVE-2025-2703

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.

A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 23, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-270306.1information disclosure while invoking calibration data from user space to update firmware size.CVE-2025-270317.8memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.CVE-2025-270327.8memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.CVE-2025-270336.1Information disclosure while running video usecase having rogue firmware.CVE-2025-270349.8Memory corruption while selecting the PLMN from SOR failed list.CVE-2025-270366.1Information disclosure when Video engine escape input data is less than expected minimum size.CVE-2025-270377.8Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.CVE-2025-270387.5Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.CVE-2025-270396.6Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.CVE-2025-27047.5OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting CVE-2025-270406.5Information disclosure may occur while processing the hypervisor log.CVE-2025-270415.5Transient DOS while processing video packets received from video firmware.