CVE-2025-9913 Cross Site Scripting: Session Hijacking

What is CVE-2025-9913?

CVE-2025-9913 is a medium-severity cross-site scripting vulnerability in SICK AG Baggage Analytics, published on 6 Oct 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.

Weakness: CWE-79

Which versions are affected by CVE-2025-9913?

It affects 4 products.

Products include Sick Baggage Analytics, Sick Logistic Diagnostic Analytics, Sick Package Analytics, Sick Tire Analytics.

How do I fix CVE-2025-9913?

No fix has been published for CVE-2025-9913 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-9913 being exploited?

There is no known exploitation of CVE-2025-9913 in the wild and no public exploit code.

Other vulnerabilities in SICK AG Baggage Analytics

• CVE-2025-49184 Information disclosure to unauthorized user High 7.5
• CVE-2025-58587 Improper Restriction of Excessive Authentication Attempts Medium 6.5
• CVE-2025-58590 Path traversal Medium 6.5
• CVE-2025-58591 Path Traversal Medium 6.5
• CVE-2025-58579 Username Disclosure Through Missing Authentication Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q7c7-4x5w-pjwf.