CVE-2025-49745

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 79.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Microsoft Dynamics 365 (on-premises) Version 9.1Microsoft Dynamics 365
Timeline
PublishedAug 12

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDmicrosoft/dynamics_3659.1 — 9.1.38.10

🔴Vulnerability Details

2
GHSA
GHSA-93q5-8wfm-rh63: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized at↗2025-08-12
▶
CVEList
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability↗2025-08-12
▶

📋Vendor Advisories

1
Microsoft
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability↗2025-08-12
▶
CVE-2025-49745 (MEDIUM CVSS 5.4) | Improper neutralization of input du | cvebase.io