CVE-2025-49185 MEDIUM

CVE-2025-49185: Stored Cross-Site-Script

Vendor Sick Ag
Product SICK Field Analytics
Weakness CWE-79 · XSS
Published June 12, 2025
Last update June 12, 2025

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.

Key dates

02Disclosure timeline

June 12, 2025 CVE published
June 12, 2025 Record updated