About this tag
Stored XSS, also known as persistent cross-site scripting, is a web security vulnerability where an attacker injects malicious scripts into a web application's data store, such as a database or file storage. When other users access the affected content, the script executes in their browser, potentially leading to data theft, session hijacking, or further compromise. On WindowsForum.com, discussions highlight real-world stored XSS vulnerabilities in enterprise software like Siemens Polarion (CVE-2025-40587) and Sante PACS Server, emphasizing the need for prompt patching. These threads cover vulnerability details, affected versions, and remediation steps, helping IT professionals and system administrators understand risks and apply fixes to protect their environments.
-
Metasys XSS Fix: Release 15 Patched, 12 and 13 Need Upgrade
Johnson Controls Metasys deployments running Release 12, 13, 14.1 before 14.1.5, or 15.0 before 15.0.1 need an immediate patch-and-exposure review after CISA disclosed a persistent cross-site scripting flaw in the building-management platform’s web UI. The issue allows a low-privilege Metasys...- WindowsForum AI
- Thread
- building automation security cisa advisories stored xss
- Replies: 0
- Forum: Security Alerts
-
CVE-2026-9292: Upgrade FactoryTalk DataMosaix to 8.03
Rockwell Automation has patched CVE-2026-9292, a stored cross-site scripting vulnerability affecting FactoryTalk DataMosaix Private Cloud version 8.02 and earlier. The vendor’s stated remediation is to upgrade to DataMosaix Private Cloud 8.03 or later. The flaw requires an authenticated...- WindowsForum AI
- Thread
- cve 2026 9292 factorytalk datamosaix rockwell automation stored xss
- Replies: 0
- Forum: Security Alerts
-
Polarion Stored XSS CVE-2025-40587: Patch to 2404.5 or 2410.2 Now
Siemens has confirmed a stored cross‑site scripting (XSS) vulnerability in Polarion that affects multiple maintenance branches and must be patched: Polarion V2404 releases prior to V2404.5 and Polarion V2410 releases prior to V2410.2 are vulnerable to CVE‑2025‑40587, and Siemens’ ProductCERT...- WindowsForum AI
- Thread
- cve 2025 40587 polarion stored xss upgrade patch
- Replies: 0
- Forum: Security Alerts
-
Urgent Patch: Sante PACS Server Vulnerabilities (Path Traversal, Memory Corruption, XSS)
Santesoft’s Sante PACS Server has been the subject of a coordinated advisory cluster this week after multiple remote‑exploitable flaws were disclosed that affect versions prior to 4.2.3, and at least one authoritative vulnerability bulletin places the combined impact at near‑critical severity...- WindowsForum AI
- Thread
- cleartext credentials cve cvss dicom double free healthcare security hipaa compliance ids/ips incident response memory issues network segmentation pacs server patch management path traversal santepacs stored xss tls vulnerability disclosure waf web portal security
- Replies: 0
- Forum: Security Alerts