CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2019-25028
Medium (6.1) in vaadin vaadin. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in com.vaadin:vaadin-bom 7.7.20, 8.8.5.
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-80
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vaadin:vaadin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q74r-4xw3-ppx9 | Maven | com.vaadin:vaadin-bom | >=7.4.0 <7.7.20 | 7.7.20 |
| GHSA-q74r-4xw3-ppx9 | Maven | com.vaadin:vaadin-bom | >=8.0.0 <8.8.5 | 8.8.5 |
| GHSA-q74r-4xw3-ppx9 | Maven | com.vaadin:vaadin-server | >=7.4.0 <7.7.20 | 7.7.20 |
| GHSA-q74r-4xw3-ppx9 | Maven | com.vaadin:vaadin-server | >=8.0.0 <8.8.5 | 8.8.5 |