Stored Cross-Site Scripting Vulnerability in Dashboard Functionality from Nozomi Networks

CVE-2025-40890

What is CVE-2025-40890?

A vulnerability in the Dashboard functionality of Nozomi Networks allows an authenticated low-privilege user to create a malicious dashboard containing a JavaScript payload. This payload can be shared with unsuspecting users or can be imported by a victim who has been socially engineered. Once the victim views or imports the compromised dashboard, the malicious JavaScript executes in their browser context, empowering the attacker to perform unauthorized actions such as altering application data, disrupting the application's availability, and accessing sensitive information that is typically restricted. It highlights the importance of robust input validation and user awareness to prevent exploitation.

References