CVE-2025-28380

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/OpenC3/cosmos/commit/12e3e12307afd3dbfc306f20d60400989db89883
https://github.com/OpenC3/cosmos/pull/1816
https://github.com/OpenC3/cosmos/releases/tag/v6.0.2
https://openc3.com/Product
https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/Exploit, Mitigation, Third Party Advisory
https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/Exploit, Mitigation, Third Party Advisory

Timeline

Published: Jun 13, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-283817.5A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all conta CVE-2025-283827.5An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.CVE-2025-283849.1An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.CVE-2025-283869.8A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary CVE-2025-283889.8OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.CVE-2025-283899.8Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.CVE-2025-28395.4The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versio CVE-2025-283957.1D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.CVE-2025-283987.1D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.CVE-2025-283999.8An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Control CVE-2025-28405.3The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl CVE-2025-284006.7An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method