CVE-2025-6248

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a web page with specially crafted content.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-624802.7Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that CVE-2025-624819.8Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2025-624826.1Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network a CVE-2025-624837.5Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a discl CVE-2025-624849.8Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to condu CVE-2025-624873.5On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the prop CVE-2025-62496.7An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions CVE-2025-624908.8In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, pr CVE-2025-624918.8A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled reject CVE-2025-624926.5A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototy CVE-2025-624936.5A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the CVE-2025-624948.8A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first c