CVE-2025-40899

HighCVSS 8.9/10Last modified Oct 14, 2026

Description

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-40905.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability CVE-2025-409004.6An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An CVE-2025-409014.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input paramet CVE-2025-409024.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authent CVE-2025-409034.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input pa CVE-2025-409045.4A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An CVE-2025-409057.3WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for CVE-2025-409069.8BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14 CVE-2025-409075.3FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI libra CVE-2025-409089.1YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified CVE-2025-409095.9Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at th CVE-2025-40918.1Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of