CVE-2025-20356

A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials that allow access to the Sensor Explorer page. By default, Admin and Product user roles have this access, as do any custom users that are configued to allow access to the Sensors page.

• CWE-79

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cv-xss-rwRAKAJ9Vendor Advisory

Published

Oct 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20350A vulnerability in the web UI of Cisco Desk Phone 9800 Serie…7.5
• CVE-2025-20351A vulnerability in the web UI of Cisco Desk Phone 9800 Serie…6.1
• CVE-2025-20352A vulnerability in the Simple Network Management Protocol (S…7.7
• CVE-2025-20353A vulnerability in the web-based management interface of Cis…6.1
• CVE-2025-20354A vulnerability in the Java Remote Method Invocation (RMI) p…9.8
• CVE-2025-20355A vulnerability in the web-based management interface of Cis…4.7
• CVE-2025-20357A vulnerability in the web-based management interface of Cis…5.4
• CVE-2025-20358A vulnerability in the Contact Center Express (CCX) Editor a…9.8
• CVE-2025-20359Multiple Cisco products are affected by a vulnerability in t…6.5
• CVE-2025-2036A vulnerability was found in s-a-zhd Ecommerce-Website-using…9.8
• CVE-2025-20360Multiple Cisco products are affected by a vulnerability in t…5.8
• CVE-2025-20361A vulnerability in the web-based management interface of Cis…4.8