4.3
Medium
CVE-2025-41228 VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input…
Description
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vCenter Server 8.0 | 8.0 → latest | No fix stated |
| Cloud Foundation | Versions not published | |
| Telco Cloud Platform | Versions not published | |
| Telco Cloud Infrastructure | Versions not published | |
| ESXi 8.0 | 8.0 → latest | No fix stated |
| ESXi 7.0 | 7.0 → latest | No fix stated |
References
- support.broadcom.com support.broadcom.com
Timeline
- Published
- Last modified
Other CVEs of vCenter Server
The 6 CVEs of vCenter Server →
CVE-2025-41225
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to…
8.8
High
CVE-2019-5532
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information…
Not rated
CVE-2019-5534
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information…
Not rated
CVE-2017-4927
VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP…
Not rated