A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's browser session.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/MatJosephs/CVEs/blob/main/CVE-2025-52358/README.md | Exploit Third Party Advisory |
| https://vivaldigroup.it/en/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
06 Aug 2025, 20:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/MatJosephs/CVEs/blob/main/CVE-2025-52358/README.md - Exploit, Third Party Advisory | |
| References | () https://vivaldigroup.it/en/ - Product | |
| First Time |
Vivaldigroup icontrol\+ Server
Vivaldigroup Vivaldigroup vivaldi Domotica Icontrol Firmware Vivaldigroup vivaldi Domotica Icontrol |
|
| CPE | cpe:2.3:h:vivaldigroup:vivaldi_domotica_icontrol:-:*:*:*:*:*:*:* cpe:2.3:a:vivaldigroup:icontrol\+_server:5.32:*:*:*:*:*:*:* cpe:2.3:o:vivaldigroup:vivaldi_domotica_icontrol_firmware:4.7.8.0.eden:*:*:*:*:*:*:* |
29 Jul 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-29 14:15
Updated : 2025-08-06 20:53
NVD link : CVE-2025-52358
Mitre link : CVE-2025-52358
JSON object : View
Products Affected
vivaldigroup
- icontrol\+_server
- vivaldi_domotica_icontrol
- vivaldi_domotica_icontrol_firmware
CWE
No CWE.