Description
A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Parsons | Parsons Utility Enterprise Data Management | 5.18, 5.03, 4.02 – ≤ 4.26, 3.30 | — |
| Parsons | AclaraONE Utility Portal | < 1.22 | 1.22 |
Advisories 1
- ICSA-25-175-06 Parsons AccuWeather widget CISA ICS & IT advisories · Jun 24, 2025