What’s Vulnerable › Vulnerabilities

CVE-2025-25247: Apache Felix Webconsole: XSS in services console

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-10 · updated 2026-06-17
• Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

Affected products

• Apache Software Foundation Apache Felix Webconsole: from 4.0.0 before 4.9.10; from 5.0.0 before 5.0.10 — fixed in 4.9.10, 5.0.10

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Felix Webconsole 4.9.10, 5.0.10. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m
• http://www.openwall.com/lists/oss-security/2025/02/10/1

Get alerted when CVE-2025-25247 or the next vulnerability affects your stack