CVE-2025-61949
- State
- Published
- Severity
- 4.8 Medium
- Published
- Nov 21, 2025
- Updated
- Nov 21, 2025
- Reserved
- Nov 10, 2025
Description
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | jpcert |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | jpcert |
Weaknesses
- CWE-79 Cross-site scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
LogStare Collector (for Windows)LogStare Inc. |
|
LogStare Collector (for Linux)LogStare Inc. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.