VulnerabilityAnalyzed
CVE-2025-61949
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement.
MEDIUM 4.8EPSS 0.17%
Does this matter?
Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.
Description
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page.
- CVSS 4.0
- 4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.17% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- secuavail/logstare collector
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN77560819/Third Party Advisory
- https://www.logstare.com/vulnerability/2025-001/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.