What’s Vulnerable › Vulnerabilities
CVE-2025-10280: Incorrect Content Type Cross-Site Scripting Vulnerability
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-03 · updated 2026-10-18
- Weakness: CWE-79
Description
IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
Affected products
- SailPoint IdentityIQ: before 8.3; 8.3, 8.3-patch1, 8.3-patch2, 8.3-patch4, 8.3-patch5, 8.4 (+3) — fixed in 8.3
How to fix
Upgrade to a fixed version: SailPoint IdentityIQ 8.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-10280 or the next vulnerability affects your stack