CVE-2025-5015 — Parsons AccuWeather Widget Cross-site Scripting

CVE-2025-5015

Parsons AccuWeather Widget Cross-site Scripting PUBLISHED

Description (CNA)

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.

Affected (CNA)

Vendor / product	Versions
Parsons / Parsons Utility Enterprise Data Management	affected 5.18; affected 5.03; affected 4.02 through 4.26; affected 3.30
Parsons / AclaraONE Utility Portal	affected 0 before 1.22

CWE

CWE-79

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-06

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.