CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

• CWE-79

• https://github.com/CleverTap/clevertap-web-sdk/issues/416
• https://github.com/CleverTap/clevertap-web-sdk/issues/416

Published

Jul 30, 2026

Last Modified

Jul 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51672A time-based blind SQL injection vulnerability was identifie…8
• CVE-2025-51677An issue was discovered in openRISC OR1200 commit 83ac6b. An…9.1
• CVE-2025-51678An issue was discovered in RISC-V PicoRV32 commit 87c89a. A …7.5
• CVE-2025-5168A vulnerability was found in Open Asset Import Library Assim…5.5
• CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, wh…9.8
• CVE-2025-51683A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7…9.8
• CVE-2025-5169A vulnerability classified as problematic has been found in …5.5
• CVE-2025-51691Cross-Site Scripting (XSS) vulnerability found in MarkTwo co…6.1
• CVE-2025-5170A vulnerability classified as critical was found in llisoft …9.8
• CVE-2025-5171A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-5172A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-51726CyberGhostVPNSetup.exe (Windows installer) is signed using t…8.4