CVE-2025-54346

HIGH

A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, ca...

Affects 1 product across 1 vendor.

CVSS 3.17.6
EPSS0.3%
Percentile18th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full availability impact.
CWE Weakness Definitions
CWE-80: CWE-80
Related Attack Patterns (CAPEC)
CAPEC-18 XSS Targeting Non-Script Elements
via CWE-80
CAPEC-32 XSS Through HTTP Query Strings
via CWE-80
CAPEC-86 XSS Through HTTP Headers
via CWE-80
CAPEC-193 PHP Remote File Inclusion
via CWE-80

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Reflected Cross Site Scripting (XSS) vulnerability was identified in Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2, enabling attackers to hijack user browsers and capture sensitive information.

BSID: BS-2025-GLOBAL-273509-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-54346?
A Reflected Cross Site Scripting (XSS) vulnerability was identified in Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2, enabling attackers to hijack user browsers and capture sensitive information.
What is the CVSS score for CVE-2025-54346?
CVE-2025-54346 has CVSS 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS: 0.3%.
Is CVE-2025-54346 actively exploited?
No confirmed active exploitation of CVE-2025-54346 as of 2026-05-30.
How do I remediate CVE-2025-54346?
Priority: IMMEDIATE. Advisory: https://desktopalert.net/cve-2025-54346/ PSIRT: [email protected]
What systems are affected by CVE-2025-54346?
CVE-2025-54346 affects Desktopalert Pingalert Application Server.
Vulnerability Details
CVE IDCVE-2025-54346
BSIDBS-2025-GLOBAL-273509-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Published2025-11-14
Last Modified2025-11-20
ICS Relevance0%
Weakness (CWE)
CWE-80
SourceNVD
Official Description

A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper handling of user input in the Application Server, allowing attackers to inject malicious scripts into web pages viewed by other users.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Desktopalert Pingalert Application Server ≥ 6.1.0.11, < 6.1.1.4
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 335 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashda56a993bbf69e3b98c88f643f6d5d94f74a4f92af58f95056e4c1f05127a7cea4576bae83b13998df083b0fc241c1edb9ee54be6c8a9df9f57e1ad5076742e6
Related CVEs affecting Desktopalert
CVE-2025-54339 10.0 An Incorrect Access Control vulnerability was found in the Application Server... CVE-2025-54347 9.9 A Directory Traversal vulnerability was found in the Application Server of De... CVE-2025-54343 9.6 An Incorrect Access Control vulnerability was found in the Application Server... CVE-2025-54338 7.5 An Incorrect Access Control vulnerability was found in the Application Server... CVE-2025-54345 7.5 An issue was found in the Application Server of Desktop Alert PingAlert versi...
View all Desktopalert CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →