CVE-2025-11682

Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.

• CWE-79
• CWE-83

• https://www.redguard.ch/blog/2025/10/27/advisory-perx-lmt-dashboard/

Published

Oct 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11677Use After Free in WebSocket server implementation in lws_han…6.3
• CVE-2025-11678Stack-based Buffer Overflow in lws_adns_parse_label in warmc…7.5
• CVE-2025-11679Out-of-bounds Read in lws_upng_emit_next_line in warmcat lib…5.9
• CVE-2025-1168A vulnerability was found in SourceCodester Contact Manager …9.8
• CVE-2025-11680Out-of-bounds Write in unfilter_scanline in warmcat libwebso…5.9
• CVE-2025-11681Denial-of-service condition in M-Files Server versions befor…6.5
• CVE-2025-11683YAML::Syck versions before 1.36 for Perl has missing null-te…6.5
• CVE-2025-11687A flaw was found in the gi-docgen. This vulnerability allows…6.1
• CVE-2025-1169A vulnerability was found in SourceCodester Image Compressor…6.1
• CVE-2025-11690An Insecure Direct Object Reference (IDOR) vulnerability exi…8.5
• CVE-2025-11691The PPOM – Product Addons & Custom Fields for WooCommerce pl…7.5
• CVE-2025-11692The Zip Attachments plugin for WordPress is vulnerable to un…5.3