Description
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | vCenter Server | 8.0 – < 8.0 U3e | 8.0 U3e |
| VMware | Cloud Foundation | 5.x, 4.5.x | — |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — |
| VMware | Telco Cloud Infrastructure | 3.x,2.x | — |
| VMware | ESXi | 8.0 – < ESXi80U3se-24659227, 7.0 – < ESXi70U3sv-24723868 | ESXi80U3se-24659227 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) EDB-52406 · webapps · Aug 11, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2025-1113 VMware Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2025
- NCSC-2025-0171 Kwetsbaarheden verholpen in VMware producten NCSC-NL (Netherlands) · May 21, 2025