Skip to main content

N A CVE-2025-45806

| EUVDEUVD-2025-209373 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-09 mitre
XSS N A Suse
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Apr 09, 2026 - 14:15 euvd
EUVD-2025-209373
Analysis Generated
Apr 09, 2026 - 14:15 vuln.today
CVE Published
Apr 09, 2026 - 00:00 nvd
MEDIUM 6.1

DescriptionCVE.org

A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

AnalysisAI

rrweb-snapshot before v2.0.0-alpha.18 contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript or HTML in a victim's browser context through a crafted payload. The vulnerability requires user interaction (clicking a malicious link) and affects client-side snapshot capture functionality. Publicly available exploit code exists according to CISA SSVC assessment, though active exploitation has not been confirmed at time of analysis.

Technical ContextAI

rrweb-snapshot is a JavaScript library for capturing and replaying web page state, commonly used in session recording and debugging applications. The vulnerability stems from inadequate input sanitization in the snapshot rendering pipeline, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The library processes DOM elements and user-supplied data without sufficient XSS filters before injecting content into the DOM, allowing malicious script tags or event handlers to execute in the context of pages using the library. This affects the client-side snapshot capture mechanism used to serialize page state.

RemediationAI

Upgrade rrweb-snapshot to version v2.0.0-alpha.18 or later. Users should update their dependency to the patched version through npm or their package manager of choice. If immediate patching is not feasible, implement Content Security Policy (CSP) headers with script-src directives to mitigate XSS execution in the context where rrweb-snapshot is deployed. Refer to the upstream repository issue tracker at https://github.com/rrweb-io/rrweb/issues/1817 for additional technical details and patch confirmation.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP applications 16.1 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP3 Fixed

Share

CVE-2025-45806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy