Severity: High
ZVE ID: ZVE-2025-7405
| Product Name | Affected Version(s) | Fixed Version(s) | Fixed On |
|---|---|---|---|
|
OpManager OpManager Enterprise Edition OpManager Plus OpManager Plus Enterprise Edition OpManager MSP |
12.8.664 and below | 12.8.665 | 10-1-2026 | 12.8.632 and below | 12.8.633 | 7-1-2026 |
| 12.8.588 and below | 12.8.589 | 13-1-2026 |
Details:
OpManager: A stored cross-site scripting (XSS) vulnerability detected in the display name of devices /interfaces has now been fixed.
Impact:
This vulnerability could allow the display name of a device or interface to be injected with malicious JavaScript code, which, when executed, could enable an attacker to access sensitive information.
Fix:
This has been addressed by sanitizing user input in the device or interface display name field to prevent script injection.
Steps to upgrade:
Source and Acknowledgements:
This vulnerability was reported by Daniel Santos.
Kindly contact our product support teams for further details, at the email address mentioned below: