CVE-2025-67741 MEDIUM

CVE-2025-67741

Vendor Jetbrains

Product TeamCity

Weakness CWE-79 · XSS

Published December 11, 2025

Last update December 11, 2025

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute

Key dates

02Disclosure timeline

December 11, 2025 CVE published

December 11, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-67741 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-52193 WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS) CVE-2024-34357 TYPO3 vulnerable to Cross-Site Scripting in ShowImageController CVE-2023-42478 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform CVE-2025-5559 TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4193 Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting