CVE-2025-54057

MediumCVSS 6.1/10Last modified Oct 18, 2026

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.

This issue affects Apache SkyWalking: <= 10.2.0.

Users are recommended to upgrade to version 10.3.0, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2025
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-540588.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was iCVE-2025-540594.4melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files gCVE-2025-54068.8A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. AffecCVE-2025-540608.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was iCVE-2025-540618.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was iCVE-2025-540628.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was iCVE-2025-540639.6Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code eCVE-2025-540646.9Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2025-540657.9GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript acCVE-2025-540664.7DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can CVE-2025-540689.8Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers CVE-2025-54075.4A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affec
CVE-2025-54057: Medium severity, CVSS 6.1 | Vulnix