CVE-2025-2261 HIGH

CVE-2025-2261: TIBCO BPM Enterprise XSS Vulnerability

Vendor Tibco Software Inc

Product TIBCO BPM Enterprise

Weakness CWE-79 · XSS

Published May 21, 2025

Last update May 21, 2025

View on NVD All CVEs

CVSS base score

7.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.

Key dates

02Disclosure timeline

May 21, 2025 CVE published

May 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-2261 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-7133 y_project RuoYi HTTP POST Request login cross site scripting CVE-2024-52453 WordPress Library Bookshelves plugin <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2021-30171 Jun-He Technology Ltd. ERP POS - Stored XSS-2 CVE-2023-48746 WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS) CVE-2025-40648 Stored Cross-Site Scripting (XSS) vulnerability in Issabel products