What’s Vulnerable › Vulnerabilities
CVE-2025-52358
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-07-29 · updated 2026-06-17
- Weakness: CWE-79
Description
A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's browser session.
Affected products
- Vivaldigroup Icontrol+ Server: 5.32
- Vivaldigroup Vivaldi Domotica Icontrol Firmware: 4.7.8.0.eden
References
Get alerted when CVE-2025-52358 or the next vulnerability affects your stack