CVE-2025-40725: Reflected Cross-Site Scripting (XSS) in Azon Dominator

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-10 · updated 2026-09-26
Weakness: CWE-79

Description

Reflected Cross-Site Scripting (XSS) vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the “q” parameter in /search via GET. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Affected products

Azon Dominator PHP script: all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-azon-dominator

Get alerted when CVE-2025-40725 or the next vulnerability affects your stack