CVE-2025-61933

MediumCVSS 6.1/10Last modified Oct 8, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 17.5.0, < 17.5.1.3; >= 17.1.0, < 17.1.3; >= 16.1.0, < 16.1.6.1; >= 15.1.0, < 15.1.10.8

References

https://my.f5.com/manage/s/article/K000156596Vendor Advisory

Timeline

Published: Oct 15, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-6193410.0A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability all CVE-2025-619357.5When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to termin CVE-2025-6193710.0The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “CVE-2025-619387.5When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protect CVE-2025-619394.4An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attack CVE-2025-619408.8NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client CVE-2025-619418.6A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative CVE-2025-619437.8The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Capt CVE-2025-619448.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-619459.8Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once ins CVE-2025-619494.8LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitra CVE-2025-61954.3GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that