Reflected Cross-Site Scripting Vulnerability in Sage DPW by Sage
CVE-2025-51531

6.1MEDIUM

Key Information:

Vendor

Sage

Status
Sage DPW
Vendor
CVE Published:
6 August 2025

What is CVE-2025-51531?

A reflected cross-site scripting vulnerability in Sage DPW v2024.12.003 enables attackers to inject arbitrary JavaScript code through the 'tabfields' parameter at the specified endpoint. This could allow manipulation of page content or unauthorized access to a user's session. Users are advised to upgrade to version 2024_12_004 to mitigate this risk effectively.

References

https://www.sec4you-pentest.com/schwachstellen/
https://www.sec4you-pentest.com/schwachstelle/sage-dpw-sc...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.