CVE-2025-43926

MEDIUM

Znuny < 6.5.14 and 7.x < 7.1.6 - Cross-Site Scripting via AgentPreferences UpdateAJAX

Title source: llm
STIX 2.1

Description

An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.

References (2)

Core 2
Core References

Scores

CVSS v3 6.1
EPSS 0.0020
EPSS Percentile 10.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
znuny/znuny < 6.5.14
Published May 08, 2025
Tracked Since Feb 18, 2026