CVE-2025-31286

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerability.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 2, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-31294.8Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access cCVE-2025-31305.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.ThiCVE-2025-31315.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affecCVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potenCVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciouCVE-2025-313264.1SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user CVE-2025-313274.3SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields couldCVE-2025-313284.6SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending uninCVE-2025-313296.2SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuraCVE-2025-313309.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFCCVE-2025-313314.3SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require addCVE-2025-313327.1Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could
CVE-2025-31286: Critical severity, CVSS 9.0 | Vulnix