{"id":"CVE-2025-10280","title":"Incorrect Content Type Cross-Site Scripting Vulnerability","summary":"IdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-79"],"vendor":"SailPoint Technologies","product":"IdentityIQ","affected":["IdentityIQ 8.5","IdentityIQ >= 8.4 < 8.4p4","IdentityIQ >= 8.3 <= 8.3p5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-11-04T04:55:16.675765Z"},"published":"2025-11-03","updated":"2026-11-04","sourceUpdated":"2026-11-04T00:12:59.919Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-10280","references":[{"url":"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280"}],"tags":["cve.org"],"epss":0.00218,"epssPercentile":0.12308,"ingestedAt":"2026-11-05T20:33:06.648Z","slug":"CVE-2025-10280","body":"## Overview\n\nIdentityIQ\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and\nall 8.3 patch levels including 8.3p5, and all prior versions allows some\nIdentityIQ web services that provide non-HTML content to be accessed via a URL\npath that will set the Content-Type to HTML allowing a requesting browser to\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS).\n\n## Affected\n\n- `IdentityIQ 8.5`\n- `IdentityIQ >= 8.4 < 8.4p4`\n- `IdentityIQ >= 8.3 <= 8.3p5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}