MEDIUM 4.3 NVD
CVE-2025-6623
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
References
- https://github.com/wso2/carbon-analytics-common/pull/870
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/W
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.