CVE-2025-40890

HighCVSS 7.9/10Last modified Oct 18, 2026

Description

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.

An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be socially engineered to import a malicious dashboard template. When the victim views or imports the dashboard, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 25, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-408914.7A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network tCVE-2025-408928.9A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. AnCVE-2025-408936.1A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An CVE-2025-408945.4A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parCVE-2025-408954.8A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected GuardiansCVE-2025-408964.8The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-miCVE-2025-408978.1An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being propeCVE-2025-408988.1A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.CVE-2025-408998.9A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input paraCVE-2025-40905.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability CVE-2025-409004.6An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. AnCVE-2025-409014.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input paramet
CVE-2025-40890: High severity, CVSS 7.9 | Vulnix