CVE-2025-11925
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-11-07
Assigner: azure-access
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| azure-access | blu-ic2_firmware | to 1.20 (exc) |
| azure-access | blu-ic2 | * |
| azure-access | blu-ic4_firmware | to 1.20 (exc) |
| azure-access | blu-ic4 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because one of the APIs incorrectly sets the Content-Type header to 'text/html' instead of 'application/json'. This misconfiguration may allow an attacker to inject malicious HTML or JavaScript code into the API's reply, potentially leading to cross-site scripting (XSS) attacks.
How can this vulnerability impact me? :
The vulnerability can allow attackers to inject malicious HTML or JavaScript into API responses, which can lead to cross-site scripting (XSS) attacks. This can result in unauthorized actions on behalf of users, theft of sensitive information such as cookies or credentials, and compromise of user sessions or systems interacting with the affected APIs.