CVE-2025-55072 Details
Description
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
A stored cross-site scripting vulnerability has been identified in desknet's NEO versions 2.0R1.0 through 9.0R2.0. This vulnerability allows the execution of arbitrary JavaScript in the web browser of users accessing the application.
Users are advised to update desknet's NEO to version 9.5 R1.0 or later. For those using the PostgreSQL or SQL Server versions, download and install the update module. Oracle version users should contact NEOJAPAN for guidance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2025CISA-ADP
Assessed Oct 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN90757550/ | [email protected] | AdvisoryBundleRemedy |
| https://www.desknets.com/neo/support/mainte/17475/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NEOJAPAN desknet's NEO | >= V2.0R1.0, <= V9.0R2.0 |
CPE
Remediation
| |
| NEOJAPAN AppSuite | All versions |
CPE
Remediation
| |
| NEOJAPAN desknet's Web Server | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | New CVE Received | [email protected] |