CVE-2025-8386Medium· 6.9▾ Sunlit

The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user,…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score38/ 100 · Low

impact 38 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 15, 2025

Updated

Oct 7, 2026

CVSS

6.9

Vendor

—

Product

—

CWE

CWE-80

Depth score

38 · Low

EPSS

0.16% · p4

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 326 days

Nov 15, 2025Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
0.2%

CWE-80 #nvd

Full technical detail▾

Overview

The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed