ZeroDay Findings
Sign inSign up

Findings

CVE-2025-40899

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter.

Published Apr 15, 2026 · updated Oct 14, 2026

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 15, 2026 · NIST NVD

    Detected

    A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unautho

  2. Oct 14, 2026 · NIST NVD

    Updated

    A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unautho

Sources

  • CVE.orgVulnerability recordCVE-2025-40899

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-40899

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2025-40899

    A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the vic

    nvd.nist.gov

References