Back Tenable

CVE-2025-15562 | Tenable®

Tenable • February 19, 2026

The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.

Published : 2026-02-19

Vector : CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Cross-Site Scripting Vulnerabilities Discovered in Web Applications Recent vulnerabilities have been identified in various web applications, including SVXportal and Dell Unisphere for PowerMax. These vulnerabilities allow unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers, potentially leading to session theft and information disclosure. The vulnerabilities were published between February 17 and February 20, 2026. 17 sources 35

Extracted Entities

CVE-2025-15562 | Tenable®

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

Vulnerabilities (1)