Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2025-13672

Severity CVSS v4.0:
HIGH
Type:
CWE-79 Cross-Site Scripting (XSS)
Publication date:
19/02/2026
Last modified:
20/02/2026

Description

Improper Neutralization of Input During Web Page Generation (XSS or &amp;#39;Cross-site Scripting&amp;#39;) vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that was then rendered with the preview of the page, so that malicious scripts could be executed on the client side.<br /> <br /> This issue affects Web Site Management Server: 16.7.0, 16.7.1.

Impact

Vector 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/S:P/AU:N/R:U/V:D/RE:H/U:Red CVSS v4.0 Severity and Metrics:

Base Score: 7.00 HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/S:P/AU:N/R:U/V:D/RE:H/U:Red

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): Low
User Interaction (UI): Passsive
Confidentiality (VC): High
Integrity (VI): Low
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): None
Availability (SA): None
Safety (S): Present
Automatable (AU): No
Recovery (R): User
Value Density (V): Diffuse
Vulnerability Response Effort (RE): High
Provider Urgency (U): Red

Base Score 4.0
7.00
Severity 4.0
HIGH

References to Advisories, Solutions, and Tools