CVE-2025-12454 Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.

Medium 5.1 Published 13 Mar 2026 Updated 13 Mar 2026

Reflected XSS in Vertica management console allows attackers to execute scripts in user sessions, potentially leading to data theft or session hijacking.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-12454?

CVE-2025-12454 is a medium-severity cross-site scripting vulnerability in OpenText™ Vertica, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X.

Weakness: CWE-79

Which versions are affected by CVE-2025-12454?

It affects 1 product.

Products include Opentext Vertica.

How do I fix CVE-2025-12454?

No fix has been published for CVE-2025-12454 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-12454 being exploited?

There is no known exploitation of CVE-2025-12454 in the wild and no public exploit code.

Sources

Also known as GHSA-96v9-4pvw-w72p.