CVE-2025-49185mediumCWE-79

CVE-2025-49185: medium-severity vulnerability in SICK Field Analytics

Stored Cross-Site-Script

Published

Follow this CVE+ Monitor SICK Field Analytics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.3%
The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
SICK AG · SICK Field Analytics
Related CVEs — SICK Field Analytics

In the same product, most dangerous first.

CVE-2025-49200MEDIUMUnencrypted backup contains sensitive informationEPSS 0.5%CVE-2025-49188MEDIUMSensitive Data in URLEPSS 0.4%CVE-2025-49187MEDIUMUser enumerationEPSS 0.4%CVE-2025-49191MEDIUMDashboards and iFrames can link malicious web contentEPSS 0.3%CVE-2025-49190MEDIUMServer-Side Request ForgeryEPSS 0.3%CVE-2025-49199HIGHBackup files can be modified and uploadedEPSS 0.3%