CVE-2025-62413Medium· 6.1▾ Sunlit

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score34/ 100 · Low

impact 33.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 16, 2025

Updated

Oct 9, 2026

CVSS

6.1

Vendor

—

Product

—

CWE

CWE-79

Depth score

34 · Low

EPSS

0.33% · p24

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 358 days

Oct 16, 2025Published
Disclosed via NVD
Oct 9, 2026Record revised
Last analysed / modified upstream
Oct 9, 2026EPSS first tracked
0.3%

CWE-79 #nvd

Full technical detail▾

Overview

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed