CVE-2025-10280highCWE-79

CVE-2025-10280: fallo de gravedad alta en SailPoint Technologies IdentityIQ

Incorrect Content Type Cross-Site Scripting Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear IdentityIQ

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.2%
IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
SailPoint Technologies · IdentityIQ
CVEs relacionadas — SailPoint Technologies IdentityIQ

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10905CRITICALIdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control VulnerabilityEPSS 0.9%CVE-2026-12341HIGHSailPoint IdentityIQ Improper Bearer Token Validation VulnerabilityEPSS 0.4%CVE-2026-4857HIGHSailPoint IdentityIQ Debug UI Incorrect AuthorizationEPSS 0.3%CVE-2026-12342CRITICALSailPoint IdentityIQ Improper Form Validation VulnerabilityEPSS 0.2%CVE-2026-5712HIGHIdentityIQ Role Editor Incorrect Authorization VulnerabilityEPSS 0.2%