Medium severity · published May 20, 2025
CVE-2025-41228
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
ESXi · VMware
8.0 before ESXi80U3se-24659227; 7.0 before ESXi70U3sv-24723868 · source: vendor
VS
vCenter Server · VMware
8.0 before 8.0 U3e · source: vendor
CF
Cloud Foundation · VMware
5.x, 4.5.x · source: vendor
TC
Telco Cloud Infrastructure · VMware
3.x,2.x · source: vendor
TC
Telco Cloud Platform · VMware
5.x, 4.x, 3.x, 2.x · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41228
support.broadcom.com
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717
More from ESXi
9.8
CVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability
9.8
CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
8.2
CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
8.2
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
7.8
CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability