Stored Cross-Site Scripting Vulnerability in desknet's NEO from DeskNet
CVE-2025-54760

4.8MEDIUM

Key Information:

Vendor

Neojapan Inc.

Status
Desknet's Neo
Vendor
CVE Published:
16 October 2025

What is CVE-2025-54760?

A stored cross-site scripting (XSS) vulnerability exists in desknet's NEO versions V9.0R2.0 and earlier, potentially allowing attackers to execute arbitrary JavaScript in a user's web browser. This can lead to unauthorized actions being performed on behalf of the user, compromising sensitive data and security.

Affected Version(s)

desknet's NEO V9.0R2.0 and earlier

References

https://www.desknets.com/neo/support/mainte/17475/
https://jvn.jp/en/jp/JVN90757550/

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54760 : Stored Cross-Site Scripting Vulnerability in desknet's NEO from DeskNet