cve.bz

CVE-2025-25247

6.1 mediumEPSS 0.7%

Medium (6.1) in apache felix webconsole. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.apache.felix:org.apache.felix.webconsole 4.9.10, 5.0.10.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4c37-7m5h-c8m9Mavenorg.apache.felix:org.apache.felix.webconsole>=4.0.0 <4.9.104.9.10
GHSA-4c37-7m5h-c8m9Mavenorg.apache.felix:org.apache.felix.webconsole>=5.0.0 <5.0.105.0.10

References

Check your stackJSON