CVE-2025-62211

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
8.7HIGH
EPSS
0.0%
top 88.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Dynamics 365 Field Service (online)Microsoft Dynamics 365
Timeline
PublishedNov 11

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NExploitability: 2.3 | Impact: 5.8

Affected Packages2 packages

▶CVEListV5microsoft/dynamics_365_field_service_(online)1.0.0 — 8.8.139.398
▶NVDmicrosoft/dynamics_365< 8.8.139.398

🔴Vulnerability Details

2
GHSA
GHSA-73jf-9jgw-p56v: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attac↗2025-11-11
▶
CVEList
Dynamics 365 Field Service (online) Spoofing Vulnerability↗2025-11-11
▶

📋Vendor Advisories

1
Microsoft
Dynamics 365 Field Service (online) Spoofing Vulnerability↗2025-11-11
▶
CVE-2025-62211 (HIGH CVSS 8.7) | Improper neutralization of input du | cvebase.io