{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-08T16:13:42.283","vulnerabilities":[{"cve":{"id":"CVE-2025-20280","sourceIdentifier":"psirt@cisco.com","published":"2025-09-03T18:15:33.153","lastModified":"2025-09-09T18:20:44.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials."}],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"psirt@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*","versionEndIncluding":"8.0.0","matchCriteriaId":"27966907-6AA4-469C-9F61-F7313444B8DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:evolved_programmable_network_manager:8.1.0:*:*:*:*:*:*:*","matchCriteriaId":"30C9B83D-54D0-4C11-BD6F-542DF7CBE6C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*","versionEndIncluding":"3.9","matchCriteriaId":"7FE6C1B6-F6DE-45A5-908A-8ADA588DDA52"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndIncluding":"3.10.6","matchCriteriaId":"4FBEDB40-E752-4649-8E93-1C281921581D"}]}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-stored-xss-XjQZsyCP","source":"psirt@cisco.com","tags":["Vendor Advisory"]}]}}]}