What is the CVSS score of CVE-2025-5412?

CVE-2025-5412 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Mist are affected by CVE-2025-5412?

CVE-2025-5412 is a low-severity vulnerability in Mist Community Edition involving cross-site scripting (CVSS 3.5).. A patch is available.

Is there a public PoC exploit available for CVE-2025-5412?

Yes, a public proof-of-concept exploit is available for CVE-2025-5412. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5412?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Mist CVE-2025-5412

EUVD-2025-16587 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-02 cna@vuldb.com

XSS Mist

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16587

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

Patch released

Mar 14, 2026 - 16:47 nvd

Patch available

PoC Detected

Nov 25, 2025 - 14:49 vuln.today

Public exploit code

CVE Published

Jun 02, 2025 - 00:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument return_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The name of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.