Stored Cross-Site Scripting Vulnerability in desknet's NEO by desknet, Inc.
CVE-2025-24833

4.8MEDIUM

Key Information:

Vendor

Neojapan Inc.

Status
Desknet's Neo
Vendor
CVE Published:
16 October 2025

What is CVE-2025-24833?

A stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0 to V9.0R2.0 enables an attacker to inject arbitrary JavaScript into a user's web browser. This can lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive data and user accounts.

Affected Version(s)

desknet's NEO V4.0R1.0 to V9.0R2.0

References

https://www.desknets.com/neo/support/mainte/17475/
https://jvn.jp/en/jp/JVN90757550/

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-24833 : Stored Cross-Site Scripting Vulnerability in desknet's NEO by desknet, Inc.