Reflected Cross-Site Scripting Vulnerability in vtenext from SicuraNext
CVE-2025-71453

5.1MEDIUM

Key Information:

Vendor

Vtenext

Status
Vtenext
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists

What is CVE-2025-71453?

A vulnerability exists in versions of vtenext prior to 25.02.2, where reflected cross-site scripting can be exploited. The flaw is located in the HomeWidgetBlockList module, which processes unsanitized widgetId values from the widgetInfoList JSON parameter. If an attacker crafts a POST request containing HTML embedded in the widgetId keys, they can execute JavaScript within the context of a victim's vtenext session, potentially leading to session hijacking or other malicious actions.

Affected Version(s)

vtenext 0 < 25.02.2

References

https://blog.sicuranext.com/vtenext-25-02-a-three-way-pat...
third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to...
technical-description
https://usermanual.vtenext.com/books/release-notes-histor...
release-notes

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mattia "0xbro" Brollo
.