Executive brief
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
Affected products
- PyPI openc3
Junglewise Threat Intelligence
CVE-2025-28380: PYSEC-2025-254 - A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via inje
CVE-2025-28380 · Severity: low · CVSS 3.1 · Published 2025-06-13
Technologies: openc3 (PyPI). Vendors: PyPI.