CVE-2025-12486

Published Nov 6, 2025

Last updated 19 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12486 is a vulnerability affecting Heimdall Data Database Proxy. It is a Cross-Site Scripting Remote Code Execution vulnerability. Remote attackers can exploit this vulnerability to execute arbitrary code on installations of Heimdall Data Database Proxy. The vulnerability exists within the handling of database event logs due to the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. Exploitation requires minimal user interaction. An attacker can leverage this vulnerability to interact with the application in the context of the target user.

Description: Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-24755.
Source: zdi-disclosures@trendmicro.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.0

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

zdi-disclosures@trendmicro.com: CWE-79

Hype score: Not currently trending

References