Live › vulnerability › CVE-2025-6623
Go to dashboardThe carbon console accepts user-supplied XML without encoding executable content, so injected scripts run in a victim's browser. An attacker can redirect users to malicious sites or alter the page interface, but session cookies are httpOnly and cannot be stolen this way.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
This page as .md · .json · in your agent: get_signal("CVE-2025-6623")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.