High · 8.7 CVE-2025-22373 EUVD-2025-10903GHSA-ggp5-cmc4-x9q4

XSS, HTML and Style injection on login page

Published Apr 14, 2025 · Updated Apr 15, 2025 · Assigned by DIVD

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles
This issue affects BASEC: from 14 Dec 2021.

Affected products

Vendor	Product	Affected	Fixed
SicommNet	BASEC	14 Dec 2021	—

Advisories 1

VA-25-104-01 SicommNet multiple vulnerabilities CISA ICS & IT advisories · Apr 23, 2025

References

https://basec.sicomm.net/login/ product
https://csirt.divd.nl/DIVD-2025-00001 third-party-advisory
https://csirt.divd.nl/CVE-2025-22373 third-party-advisory