CVE-2025-6235
Medium
Description
In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.
SeverityMedium
CVSS6.1
Exploit probability—
ProductExtremenetworks Extremecontrol
PublishedJul 21, 2025
First seenJul 21, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- extremenetworks extremecontrol25.5.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| extremenetworks extremecontrol | v < 25.5.12 | 25.5.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.