BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-05

Assigner: JPCERT/CC

Description

LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-05

Generated

2026-07-06

AI Q&A

2025-11-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61949

EUVD

EUVD-2025-198427

Affected Vendors & Products

Vendor	Product	Version / Range
secuavail	logstare_collector	to 2.4.2 (exc)
linux	linux_kernel	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the UserManagement component of LogStare Collector. It occurs when malicious user information containing a crafted script is stored and later executed in the web browser of anyone who logs into the product's management page, potentially allowing attackers to run arbitrary scripts.

Impact Analysis

The vulnerability can lead to arbitrary script execution in the web browser of users who access the management page, which may result in unauthorized actions, data theft, session hijacking, or other malicious activities performed by attackers exploiting the stored XSS.

Hi! I’m here to help you understand CVE-2025-61949. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70