Vulnerability · Published Nov 3, 2025 · Assigned by SailPoint

CVE-2025-10280Incorrect Content Type Cross-Site Scripting Vulnerability

High 7.1

In plain English

A high-severity cross-site scripting in IdentityIQ from SailPoint Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).

Affected products (as reported)

Vendor	Product	Versions
SailPoint Technologies	IdentityIQ	8.58.4 – before 8.4p48.3 – through 8.3p5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280