Vulnerability · Published May 8, 2025 · Assigned by mitre
CVE-2025-43926
Medium 6.1
In plain English
A medium-severity cross-site scripting in the znuny package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | znuny | no fix listed | DEBIAN-CVE-2025-43926 |
| Debian:13 | znuny | 6.5.15-2 | DEBIAN-CVE-2025-43926 |
| Debian:14 | znuny | 6.5.15-2 | DEBIAN-CVE-2025-43926 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2025-43926 |
| Ubuntu:25.10 | znuny | no fix listed | UBUNTU-CVE-2025-43926 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2025-43926 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2025-43926 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N