VulnerabilityAnalyzed

CVE-2025-54965

An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2.

MEDIUM 6.1EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it in the job status page. An attacker who is able to social engineer a user into clicking a malicious link may be able to execute arbitrary JavaScript in the victim's browser.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: baesystems/socet gxp
Source: cve@mitre.org

References

https://www.baesystems.com/en-us/product/geospatial-exploitation-productsProduct
https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54965Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.