What’s Vulnerable › Vulnerabilities

CVE-2025-49185: Stored Cross-Site-Script

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-12 · updated 2026-06-17
• Weakness: CWE-79

Description

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboard widgets can inject malicious JavaScript code into the Transform Function which will be executed when the widget receives data from its data source.

Affected products

• SICK AG SICK Field Analytics: all versions

References

• https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF
• https://sick.com/psirt
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• https://www.first.org/cvss/calculator/3.1
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.json
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0007.pdf

Get alerted when CVE-2025-49185 or the next vulnerability affects your stack