CVE-2025-62211
published 2025-11-11CVE-2025-62211: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to…
PriorityP344high8.7CVSS 3.1
AVNACLPRLUIRSCCHIHAN
EPSS
0.59%
44.1th percentile
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | dynamics_365 | < 8.8.139.398 | 8.8.139.398 |
| microsoft | dynamics_365_field_service | >= 1.0.0 < 8.8.139.398 | 8.8.139.398 |
| msrc | dynamics_365_field_service | — | — |
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
vendor_msrc8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Dynamics 365 Field Service (online) Spoofing Vulnerability
vendor_msrc·2025-11-11·CVSS 8.7
CVE-2025-62211 [HIGH] CWE-79 Dynamics 365 Field Service (online) Spoofing Vulnerability
Dynamics 365 Field Service (online) Spoofing Vulnerability
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
FAQ: According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious link and convince the user to open it.
FAQ: What actions do customers need to take to protect themselves from this vulnerability?
Customers running Dynamics 365 Field Service (online) need to go to the Power Platform admin center and apply the updates. See Update apps and solutions for more information about updating your Fie
GHSA
GHSA-73jf-9jgw-p56v: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attac
ghsa_unreviewed·2025-11-11
CVE-2025-62211 [HIGH] CWE-79 GHSA-73jf-9jgw-p56v: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attac
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
No detection rules found.
No public exploits indexed.
2025-11-11
Published