Cross-Site Scripting (XSS) in PdfViewer
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progress | Kendo UI for jQuery | 2024.4.1112 – 2025.2.520 | — | No fix listed | CNA |
| Progress | Kendo UI for Angular | 18.5.0 – 19.1.2 | — | No fix listed | CNA |
| Progress | KendoReact | 5.10.0 – 11.1.0 | — | No fix listed | CNA |
| Progress | Telerik UI for ASP.NET MVC | 2024.4.1112 – 2025.2.520 | — | No fix listed | CNA |
| Progress | Telerik UI for ASP.NET Core | 2024.4.1112 – 2025.2.520 | — | No fix listed | CNA |
| Progress | Telerik UI for Blazor | 3.6.0 – 9.0.0 | — | No fix listed | CNA |
- Kendo UI for jQuery VendorProgress Affected 2024.4.1112 – 2025.2.520 Fixed in — No fix listed CNA
- Kendo UI for Angular VendorProgress Affected 18.5.0 – 19.1.2 Fixed in — No fix listed CNA
- KendoReact VendorProgress Affected 5.10.0 – 11.1.0 Fixed in — No fix listed CNA
- Telerik UI for ASP.NET MVC VendorProgress Affected 2024.4.1112 – 2025.2.520 Fixed in — No fix listed CNA
- Telerik UI for ASP.NET Core VendorProgress Affected 2024.4.1112 – 2025.2.520 Fixed in — No fix listed CNA
- Telerik UI for Blazor VendorProgress Affected 3.6.0 – 9.0.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-6725
- 2026-10-03 Alias added: GHSA-j73g-jxqg-3cqj
References
Other 6
- https://www.telerik.com/blazor-ui/documentation/knowledge-base/pdfviewer-xss-vulnerability-cve-2025-6725
- https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
- https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
- https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
- https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
- https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725
More Progress vulnerabilities
- TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
- TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
- TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-6725 · CVE Program
- CVE-2025-6725 · NVD
- FIRST EPSS
- GHSA-j73g-jxqg-3cqj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences