Skip to content
OpenAdvisories
Medium VA-25-345-01 1 CVE

CISA Software Acquisition Guide Supplier Response Web Tool XSS

Published Dec 12, 2025 · Updated Dec 12, 2025

Vendor: CISA Product: Software Acquisition Guide Tool

Summary

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

Vulnerabilities 1

  • Medium 4.4
    CVE-2025-67634

    Software Acquisition Guide Supplier Response Web Tool XSS

    The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file…

    CISA Software Acquisition Guide Tool

Revision history

  1. #1.0.0

    Initial publication