Read the docs
TI-2025-44009 Aliases CVE-2025-71453GHSA-44fg-83c3-2cjh

Reflected XSS in VTENext HomeWidgetBlockList via widgetInfoList

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

VTENext before 25.02.2 contains a reflected cross-site scripting flaw in modules/Home/HomeWidgetBlockList.php, where the widgetId keys of the widgetInfoList JSON parameter are echoed without sanitization (CWE-79). An unauthenticated remote attacker can induce a logged-in user to submit a crafted POST request, executing JavaScript in the victim's VTENext session. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed vtenext (vtenext): 25.02.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vtenextvtenextbefore 25.02.225.02.2Patch availableCNA
  • vtenext Vendorvtenext Affected before 25.02.2 Fixed in 25.02.2 Patch available CNA

Remediation

Upgrade vtenext to version 25.02.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA vtenext (vtenext) Fixed in 25.02.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    vtenext 25.02.2

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-44012 SQL injection in VTENext Fax EditView exposes database contentsPriority HIGH 72
    • TI-2025-44010 CSRF protection bypass in vtenext via non-POST requestsPriority MEDIUM 64
    • TI-2025-44011 vtenext Session Identifier Disclosure via Touch Web ServicePriority MEDIUM 60
    Show all 4 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2025-71453
  2. 2026-11-04 Alias added: GHSA-44fg-83c3-2cjh
  3. 2026-11-05 CISA SSVC decision points changed

References

Exploit 1

Other 2

  • TI-2025-44013 Authentication bypass in VTENext allows password changes CVSS 4.0CRITICAL 9.3
  • TI-2025-44012 SQL injection in VTENext Fax EditView exposes database contents CVSS 4.0HIGH 8.6
  • TI-2025-44010 CSRF protection bypass in vtenext via non-POST requests CVSS 4.0MEDIUM 6.9
  • TI-2025-44011 vtenext Session Identifier Disclosure via Touch Web Service CVSS 4.0MEDIUM 5.9
  • TI-2020-08240 A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload… CVSS 3.1HIGH 8.8
  • TI-2020-08241 A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an… CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences