CVE-2025-51531

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-51531
A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injecting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.
CVSS

No CVSS.

References
Link Resource
https://www.sec4you-pentest.com/schwachstelle/sage-dpw-schwachstelle-xss-in-db-monitor-tabfields/
https://www.sec4you-pentest.com/schwachstellen/
Configurations

No configuration.

History

11 Aug 2025, 16:15

Type Values Removed Values Added
Summary A reflected cross-site scripting (XSS) vulnerability in Sage DPW v2024.12.003 allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injcting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. This is fixed in Halbjahresversion 2024_12_004. A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injecting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.

06 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-06 16:15

Updated : 2025-08-11 16:15

NVD link : CVE-2025-51531

Mitre link : CVE-2025-51531

JSON object : View

Products Affected

No product.

CWE

No CWE.