Is CVE-2025-13902 actively exploited?

No active exploitation of CVE-2025-13902 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-13902 be exploited remotely?

Yes. CVE-2025-13902 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-13902?

CVE-2025-13902 has a CVSS score of 5.1 (MEDIUM).

HOME VULNERABILITIESCVE-2025-13902

MEDIUM

CVE-2025-13902

CWE-79Published: March 10, 2026· Updated: Mar 11, 2026

5.1

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.1th

Official Description

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.

NVD Source

Technical Analysis

CVE-2025-13902 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2025-13902

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058

CISA Alerts· Mar 19, 2026

View CSAF Summary Successful exploitation of this vulnerability may risk a Cross-site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser. The following versions of Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 are affected: Modicon M241 versions prior to 5.4.13.12 Modicon_Controller_M241 Modicon M251 versions prior to 5.4.13.12 Modicon_Controller_M251 Modicon Controllers M258 all firmware versions Modicon_Controllers_M258 Modicon Controllers LMC058 all firmware versions Modicon_Controllers_LMC058 CVSS Vendor Equipment Vulnerabilities v3 5.4 Schneider Electric Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 Improper Neutralizatio [xlite_meta score:79 src:CISA Alerts xlite_fp:2e17307d1db40f690aeb19e34ac620f40af7e80c6d36ca3ea9509918184cdfd5]