CVE-2025-53883
NoneCVSS
—
EPSS
0.3%
Published
Oct 30, 2025
CISA due date
—
The record
A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Manager Proxy LTS 4.3 | release-notes-susemanager-proxy | 0 | 4.3.16.1-150400.3.101.2 |
| SUSE:Manager Proxy LTS 4.3 | rhnlib | 0 | 4.3.7-150400.3.9.4 |
| SUSE:Manager Proxy LTS 4.3 | spacewalk-backend | 0 | 4.3.34-150400.3.58.6 |
| SUSE:Manager Proxy LTS 4.3 | spacewalk-web | 0 | 4.3.46-150400.3.63.5 |
| SUSE:Manager Proxy LTS 4.3 | susemanager-build-keys | 0 | 15.4.11-150400.3.38.1 |
| SUSE:Manager Proxy LTS 4.3 | susemanager-tftpsync-recv | 0 | 4.3.11-150400.3.15.3 |
| SUSE:Manager Server LTS 4.3 | release-notes-susemanager | 0 | 4.3.16.1-150400.3.143.2 |
| SUSE:Manager Server LTS 4.3 | rhnlib | 0 | 4.3.7-150400.3.9.4 |
| SUSE:Manager Server LTS 4.3 | spacewalk-backend | 0 | 4.3.34-150400.3.58.6 |
| SUSE:Manager Server LTS 4.3 | spacewalk-java | 0 | 4.3.88-150400.3.113.5 |
| SUSE:Manager Server LTS 4.3 | spacewalk-web | 0 | 4.3.46-150400.3.63.5 |
| SUSE:Manager Server LTS 4.3 | susemanager-build-keys | 0 | 15.4.11-150400.3.38.1 |
| SUSE:Manager Server LTS 4.3 | susemanager-sls | 0 | 4.3.50-150400.3.68.1 |
Related vulnerabilities
- CVE-2025-53880 A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a… Also affects release-notes-susemanager-proxy
- CVE-2026-52773 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-52774 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a… CWE-80
- CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG… CWE-80
- CVE-2026-55696 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. CWE-80
- CVE-2026-5218 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)… CWE-80
- CVE-2026-20232 A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE)… CWE-80