Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-5015

Parsons AccuWeather Widget Cross-site Scripting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Parsons Parsons Utility Enterprise Data Management

Default version status: unaffected

  • 5.18affected
  • 5.03affected
  • 4.02 to ≤ 4.26affected
  • 3.30affected

Parsons AclaraONE Utility Portal

Default version status: unaffected

  • 0 to < 1.22affected

References