← Database

CVE-2025-71453

MEDIUM CVSS: 6.1 Published: 2026-11-04 Modified: 2026-11-04

Description

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.

Affected Platforms

Unknown

Weakness Type

CWE-79

References