CVE-2025-71453

Received Received - Intake

Reflected XSS in vtenext via widgetId Parameter

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2025-71453

EUVD

EUVD-2025-211251

Affected Vendors & Products

Vendor	Product	Version / Range
vtenext	vtenext	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2025-71453 is a reflected cross-site scripting (XSS) vulnerability in vtenext versions before 25.02.2. It occurs in the HomeWidgetBlockList component where unsanitized widgetId keys from the widgetInfoList JSON parameter are echoed without proper input validation. Attackers can craft a POST request with malicious HTML or JavaScript in widgetId keys, which executes in the victim's vtenext session when submitted by a logged-in user.

Detection Guidance

Check vtenext version for versions before 25.02.2. Monitor network traffic for POST requests to modules/Home/HomeWidgetBlockList.php with widgetInfoList parameters containing unsanitized widgetId keys. Look for unusual JavaScript execution in user sessions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a logged-in user's vtenext session. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim. If combined with other vulnerabilities, it may enable further attacks like remote code execution or authentication bypass.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable vtenext versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade vtenext to version 25.02.2 or later immediately. Apply input validation to sanitize widgetId keys in widgetInfoList parameters. Implement strict CSP headers to mitigate XSS impact. Review and restrict access to sensitive endpoints.

Hi! I’m here to help you understand CVE-2025-71453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...