CVE-2025-43924

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-03 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by an admin, allow stored XSS.

Affected products

Unicomsi Focal Point: 7.6.1

References

https://www.unicomsi.com/products/focal-point/
https://www.unicomsi.com/security-advisory/

Get alerted when CVE-2025-43924 or the next vulnerability affects your stack