--- cve: "CVE-2025-55063" severity: "MEDIUM" cvss: 4.8 epss: "15%" vendor: "Priority" kev: false exploited: false published: "2025-12-29 18:15:43" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-15T06:11:08+02:00" --- # CVE-2025-55063 > 4.8 MEDIUM ## Beschreibung CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Hoch | good | | UI Interaktion | Erforderlich | good | | S Scope | Verändert | bad | | C Vertraulichkeit | Gering | warn | | I Integrität | Gering | warn | | A Verfügbarkeit | Keine | good | ## Schwachstellen-Klasse - **CWE-79** — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. ## Angriffsmuster (CAPEC) - [CAPEC-63 — Cross-Site Scripting (XSS)](https://capec.mitre.org/data/definitions/63.html) _(Severity: Very High)_ - [CAPEC-85 — AJAX Footprinting](https://capec.mitre.org/data/definitions/85.html) _(Severity: Low)_ - [CAPEC-209 — XSS Using MIME Type Mismatch](https://capec.mitre.org/data/definitions/209.html) _(Severity: Medium)_ - [CAPEC-588 — DOM-Based XSS](https://capec.mitre.org/data/definitions/588.html) _(Severity: Very High)_ - [CAPEC-591 — Reflected XSS](https://capec.mitre.org/data/definitions/591.html) _(Severity: Very High)_ - [CAPEC-592 — Stored XSS](https://capec.mitre.org/data/definitions/592.html) _(Severity: Very High)_ ## Referenzen - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-55063) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_