THREAT OPS › Threat News › [NVD] CVE-2025-13873 (MEDIUM 5.4) — Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
[NVD] CVE-2025-13873 (MEDIUM 5.4) — Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
CVE-2025-13873 CVSS: 5.4 MEDIUM Published: 2025-12-02T10:16:02.073
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2025-13873cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-13873