CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attacke…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 10, 2026 · NIST NVD

   Detected

   CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

2. Jun 23, 2026 · NIST NVD

   Updated

   CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

Affected

• cpe schneider-electric/modicon lmc058 firmwareversion unspecified
• cpe schneider-electric/modicon m241 firmwareversion unspecified
• cpe schneider-electric/modicon m251 firmwareversion unspecified
• cpe schneider-electric/modicon m258 firmwareversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2025-13902

  CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element

  nvd.nist.gov

References

• Vendor Advisory · download.schneider-electric.com