{"id":"CVE-2025-71453","title":"vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList","summary":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"vtenext","product":"vtenext","affected":["vtenext < 25.02.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:14:17.919932Z"},"published":"2026-11-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:14:26.910Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71453","references":[{"url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist","label":"VulnCheck Advisory: vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList"}],"tags":["cve.org"],"epss":0.00243,"epssPercentile":0.15638,"ingestedAt":"2026-11-05T22:38:31.517Z","slug":"CVE-2025-71453","body":"## Overview\n\nvtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.\n\n## Affected\n\n- `vtenext < 25.02.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}