CVE-2025-49745 MEDIUM

CVE-2025-49745: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor Microsoft
Product Microsoft Dynamics 365 (on-premises) version 9.1
Weakness CWE-79 · XSS
Published August 12, 2025
Last update February 13, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.

Key dates

02Disclosure timeline

August 12, 2025 CVE published
February 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-53215 WordPress Yahoo! WebPlayer Plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability CVE-2026-4918 IBM Guardium Data Protection is affected by multiple vulnerabilities CVE-2025-13367 User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2025-6696 LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scripting CVE-2025-3794 WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter