CVE-2025-41228 json
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
published 2025-05-20 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-15830
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 1
- Exploit-DB
Summary
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Patch / fix
- VMware vCenter Server 8.0 U3e
- VMware ESXi ESXi70U3sv-24723868, ESXi80U3se-24659227
Timeline
- Published
- First public exploit (EDB-52406)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52406 VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) webapps, 2025-08-11
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
Affected products
- VMware vCenter Server
- VMware Cloud Foundation
- VMware Telco Cloud Platform
- VMware Telco Cloud Infrastructure
- VMware ESXi
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- CVE List CVE-2025-41228
- NVD CVE-2025-41228
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.