CVE-2025-51684

MediumCVSS 6.1/10Last modified Oct 13, 2026

Description

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-51695.5A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ICVE-2025-516916.1Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attackeCVE-2025-51709.8A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitCVE-2025-51719.8A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function CVE-2025-51729.8A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /validCVE-2025-517268.4CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attCVE-2025-51737.8A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problCVE-2025-517335.5Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517345.4Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517357.5CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-517366.3File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.CVE-2025-51747.8A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the