Medium · 4.8 CVE-2025-41681 EUVD-2025-22073GHSA-2vx3-x6q5-g22g

Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

Published Jul 21, 2025 · Updated Nov 3, 2025 · Assigned by CERTVDE

Vendor: Helmholz Vendor: MB connect line Product: mbNET.mini Product: REX 100

Description

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.

Affected products

Vendor	Product	Affected	Fixed
MB connect line	mbNET.mini	0.0.0 – < 2.3.3	2.3.3
Helmholz	REX 100	0.0.0 – < 2.3.3	2.3.3

Advisories 2

VDE-2025-059 Helmholz: Multiple vulnerabilities in REX 100 CERT@VDE · Jul 21, 2025
VDE-2025-058 MB connect line: Multiple vulnerabilities in mbNET.mini CERT@VDE · Jul 21, 2025

References

https://certvde.com/de/advisories/VDE-2025-058