CVE-2025-40772High· 7.4▾ TwilightA vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page.
Successful exploitation allows an attacker to impersonate other users within the application and steal their session data. This could enable unauthorized access to accounts and potentially lead to privilege escalation.
sipass_integrated < 3.00Upgrade past the affected range:
sipass_integrated 3.00Connected by shared product, vendor, weakness, or advisory.
CVE-2025-40773Low· 3.5A vulnerability has been identified in SiPass integrated (All versions < V3.0)
CVE-2025-40774Medium· 4.4A vulnerability has been identified in SiPass integrated (All versions < V3.0)
CVE-2026-78557High· 8.3A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
CVE-2026-63357Medium· 6.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fun…
CVE-2026-63356Medium· 6.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who …
CVE-2026-63355Medium· 6.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the …