CVE-2025-27442

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Zoom Communications, IncZoom Workplace AppsSee references.

References

Timeline

Published
Apr 8, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-274435.5Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrCVE-2025-274444.8A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling CVE-2025-274455.4A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated userCVE-2025-274467.8Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions CVE-2025-274476.1The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code intCVE-2025-274485.4The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code intCVE-2025-274499.8The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, makiCVE-2025-27456.5A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticatedCVE-2025-274506.5The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencryptedCVE-2025-274515.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwoCVE-2025-274527.5The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activCVE-2025-274536.5The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
CVE-2025-27442: Medium severity, CVSS 5.2 | Vulnix