← back
CVE-2025-9913mediumCWE-79

Cross Site Scripting: Session Hijacking

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.5epss 0.3%
exploitation probability
0.3%top 78% of all CVEs
observed exploitation
nono source reports it
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected products
SICK AG · Baggage AnalyticsSICK AG · Logistic Diagnostic AnalyticsSICK AG · Package AnalyticsSICK AG · Tire Analytics
References
https://sick.com/psirthttps://www.cisa.gov/resources-tools/resources/ics-recommended-practiceshttps://www.first.org/cvss/calculator/3.1https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdfhttps://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.jsonhttps://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf