CVE-2025-40899 - Vulnerability Analysis

Overview

An application contains a stored XSS caused by improper validation of input in Assets and Nodes functionality, letting authenticated users with custom fields privileges execute scripts in victim browsers, exploit requires authenticated user with custom fields privileges.

Severity & Score

Impact

Attackers can execute scripts in victim browsers, enabling data modification, disruption, and access to sensitive information.

Mitigation

Update to the latest version with proper input validation and sanitization.

References

• https://security.nozominetworks.com/NN-2026:2-01

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner