CVE-2025-5015

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.

Score

CVSS 3.1 8.8 High

Status

Deferred - ics-cert@hq.dhs.gov

Published

2025-06-25

Last modified

2025-06-25

Weaknesses

CWE-79

Affected products

• Aclaraone Utility Portal (Parsons)
• Parsons Utility Enterprise Data Management (Parsons)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-06