CVE-2025-43924

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...

CVE-2025-43924

creationtimestamp| type| source ---|---|--- 2025-06-03 15:49:40+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpndniq7pj2...

CVE-2025-43924

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...

CVE-2025-43924

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController for /fp/admin/settings/loginpage and the rootserviceurl parameter in FriendsController for /fp/admin/settings/friends, entered by an admin, allow stored XSS...

CVE-2025-43924

A stored Cross Site Scripting (XSS) vulnerability exists in Unicom Focal Point version 7.6.1 , a portfolio management and decision analysis tool. The issue stems from improper neutralization of input in the val parameter of the SettingController (at the /fp/admin/settings/loginpage endpoint) and ...