CVE-2025-12776

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience.  Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. The Report Builder is part of the WebConsole.  The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.

• CWE-79

• https://documentation.commvault.com/securityadvisories/CV_2025_06_3.htmlVendor Advisory

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12770The New User Approve plugin for WordPress is vulnerable to u…5.3
• CVE-2025-12771IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-bas…7.8
• CVE-2025-12772Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Swit…4.9
• CVE-2025-12773A vulnerability in update-reports-purge-settings.sh script l…6.5
• CVE-2025-12774A vulnerability in the migration script for Brocade SANnav b…7.5
• CVE-2025-12775The WP Dropzone plugin for WordPress is vulnerable to authen…8.8
• CVE-2025-12777The YITH WooCommerce Wishlist plugin for WordPress is vulner…5.3
• CVE-2025-12778The Ultimate Member Widgets for Elementor – WordPress User D…5.3
• CVE-2025-12779Improper handling of the authentication token in the Amazon …8.8
• CVE-2025-1278An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-12780Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-12781When passing data to the b64decode(), standard_b64decode(), …5.3