What’s Vulnerable › Vulnerabilities

CVE-2025-6725: Cross-Site Scripting (XSS) in PdfViewer

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-02 · updated 2026-06-17
• Weakness: CWE-79

Description

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

Affected products

• Progress Software Kendo UI for jQuery: from 2024.4.1112 through 2025.2.520
• Progress Software Kendo UI for Angular: from 18.5.0 through 19.1.2
• Progress Software KendoReact: from 5.10.0 through 11.1.0
• Progress Software Telerik UI for ASP.NET Core: from 2024.4.1112 through 2025.2.520
• Progress Software Telerik UI for ASP.NET MVC: from 2024.4.1112 through 2025.2.520
• Progress Software Telerik UI for Blazor: from 3.6.0 through 9.0.0

References

• https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
• https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
• https://www.telerik.com/blazor-ui/documentation/knowledge-base/pdfviewer-xss-vulnerability-cve-2025-6725
• https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
• https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
• https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725

Get alerted when CVE-2025-6725 or the next vulnerability affects your stack