CVE-2025-64730

MediumCVSS 6.1/10Last modified Oct 18, 2026

Description

Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Sony Corporation	SNC-CX600W	all versions

References

https://jvn.jp/en/jp/JVN75140384/Third Party Advisory
https://www.sony.com/electronics/support/ip-cameras-fixed/snc-cx600wProduct

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-647337.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-647342.4Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to pe CVE-2025-647357.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-647367.1An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb CVE-2025-647385.5External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclos CVE-2025-647397.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via n CVE-2025-64749.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unkno CVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user CVE-2025-647419.8Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalati CVE-2025-647443.5OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with CVE-2025-647456.1Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists CVE-2025-647465.4Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean