QSearchQSearch

CVE-2026-25624

5.7 MEDIUM

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Manage...

Published: 2026-06-05 · Last updated: 2026-06-08

Severity and scoring

CVSS
5.7 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
CWE
CWE-79

Affected products

VendorProduct
aristang_firewall

Description

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-25623 — An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista N... (6.0 MEDIUM)
  • CVE-2026-25622 — A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall... (6.0 MEDIUM)
  • CVE-2026-25621 — A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due t... (6.0 MEDIUM)
  • CVE-2026-25620 — An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management... (6.0 MEDIUM)
  • CVE-2026-7473 — On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups,... (5.8 MEDIUM)

Same CWE

  • CVE-2026-2827 — The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in ... (4.7 MEDIUM)
  • CVE-2026-42558 — Xibo is an open source digital signage platform with a web content management system and Windows display player software (7.6 HIGH)
  • CVE-2026-53742 — Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template (5.4 MEDIUM)
  • CVE-2026-53741 — Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding (5.4 MEDIUM)
  • CVE-2026-53740 — Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice (5.4 MEDIUM)