---
id: CVE-2025-10280
title: Incorrect Content Type Cross-Site Scripting Vulnerability
summary: >-
  IdentityIQ

  8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3
  and

  all 8.3 patch levels including 8.3p5, and all prior versions allows some

  IdentityIQ web services that provide non-HTML content to be accessed via …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-79
vendor: SailPoint Technologies
product: IdentityIQ
affected:
  - IdentityIQ 8.5
  - IdentityIQ >= 8.4 < 8.4p4
  - IdentityIQ >= 8.3 <= 8.3p5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-11-04T04:55:16.675765Z'
published: '2025-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:12:59.919Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-10280'
references:
  - url: >-
      https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280
tags:
  - cve.org
epss: 0.00218
epssPercentile: 0.12308
ingestedAt: '2026-11-05T20:33:06.648Z'
---

## Overview

IdentityIQ
8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and
all 8.3 patch levels including 8.3p5, and all prior versions allows some
IdentityIQ web services that provide non-HTML content to be accessed via a URL
path that will set the Content-Type to HTML allowing a requesting browser to
interpret content not properly escaped to prevent Cross-Site Scripting (XSS).

## Affected

- `IdentityIQ 8.5`
- `IdentityIQ >= 8.4 < 8.4p4`
- `IdentityIQ >= 8.3 <= 8.3p5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.