QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-67634

Back to search

CVE-2025-67634

Published: Dec 12, 2025

Modified: Jan 8, 2026

PUBLISHED

CVSS v3.1

4.4

MEDIUM

Description

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

VendorProductVersions

CISA

Software Acquisition Guide Tool

affected
0 - < 2025-12-11
unaffected
2025-12-11

Weaknesses (CWE)

CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

References

url
product
url
government-resource
third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now