CVE-2025-12251

LOW

OpenWGA 7.11.12 Build 737 - Cross-Site Scripting in Admin UI

Title source: llm
STIX 2.1

Description

A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.329922
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.329922
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.673919

Scores

CVSS v3 3.5
EPSS 0.0020
EPSS Percentile 10.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
n/a/OpenWGA 7.11.12 Build 737
Published Oct 27, 2025
Tracked Since Feb 18, 2026