CVE-2025-14773
8.0 HIGHImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus
Published: 2026-06-03 · Last updated: 2026-06-04
Severity and scoring
- CVSS
- 8.0 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CWE
- CWE-79
Affected products
| Vendor | Product |
|---|---|
| abb | t-mac_plus |
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
Source: NVD
References
Related CVEs
Same vendor
- CVE-2025-14774 — Incorrect Authorization vulnerability in ABB T-MAC Plus (7.4 HIGH)
- CVE-2025-14772 — Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus (8.8 HIGH)
- CVE-2025-14771 — Files or directories accessible to external parties vulnerability in ABB T-MAC Plus (9.9 CRITICAL)
- CVE-2019-10953 — ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions (7.5 HIGH)
Same CWE
- CVE-2026-2827 — The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in ... (4.7 MEDIUM)
- CVE-2026-42558 — Xibo is an open source digital signage platform with a web content management system and Windows display player software (7.6 HIGH)
- CVE-2026-53742 — Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template (5.4 MEDIUM)
- CVE-2026-53741 — Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding (5.4 MEDIUM)
- CVE-2026-53740 — Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice (5.4 MEDIUM)