CVE-2025-40681

Summary: CVE-2025-40681 describes a reflected XSS in xCally Omnichannel 3.30.1. The vulnerability arises when a attacker-provided value in the failureMessage parameter of the /login endpoint is reflected into the victim’s browser, allowing execution of arbitrary JavaScript. This can enable theft ...