CVE-2025-49191 Dashboards and iFrames can link malicious web content

Medium 4.8 Published 12 Jun 2025 Updated 12 Jun 2025

Authorized users can inject malicious code via iFrame URLs in dashboards, leading to code execution against other users.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-49191?

CVE-2025-49191 is a medium-severity cross-site scripting vulnerability in SICK Field Analytics, published on 12 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.

Weakness: CWE-1021

Which versions are affected by CVE-2025-49191?

It affects 1 product.

Products include Sick Field Analytics.

How do I fix CVE-2025-49191?

No fix has been published for CVE-2025-49191 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-49191 being exploited?

There is no known exploitation of CVE-2025-49191 in the wild and no public exploit code.

Sources

Also known as GHSA-cxg4-v879-p568.