CVE-2025-2981

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation of the argument redirect leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-298107.5Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.CVE-2025-298117.8Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.CVE-2025-298127.8Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.CVE-2025-298139.8Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.CVE-2025-298148.8Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.CVE-2025-298157.6Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.CVE-2025-298167.5Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-298175.7Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.CVE-2025-298196.2External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.CVE-2025-29826.3A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulationCVE-2025-298207.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-298215.5Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
CVE-2025-2981: Low severity, CVSS 3.5 | Vulnix