CVE-2025-3840 LOW

CVE-2025-3840: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vendor Saviynt
Product OVA based Connect
Weakness CWE-79 · XSS
Published April 21, 2025
Last update April 21, 2025
View on NVD All CVEs

CVSS base score

2.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate the action parameter of the login form to inject malicious scripts which would lead to a XSS attack under certain conditions.

Key dates

02Disclosure timeline

April 21, 2025 CVE published
April 21, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-25595 InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard CVE-2026-25154 LocalSend has Stored XSS in Web Share Interface via Filename CVE-2025-53289 WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability CVE-2025-53458 WordPress Goracash Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability CVE-2025-22338 WordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerability