CVE-2025-54057— Apache SkyWalking: Stored XSS vulnerability
Quick assessment
Affected
Apache Software Foundation Apache SkyWalking
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache SkyWalking是美国阿帕奇（Apache）基金会的一款主要用于微服务、云原生和基于容器等环境的应用程序性能监视器。 Apache SkyWalking 10.2.0及之前版本存在安全漏洞，该漏洞源于未正确处理脚本相关HTML标签，可能导致基本跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-54057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache SkyWalking: Stored XSS vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.
This issue affects Apache SkyWalking: <= 10.2.0.
Users are recommended to upgrade to version 10.3.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache SkyWalking 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache SkyWalking是美国阿帕奇（Apache）基金会的一款主要用于微服务、云原生和基于容器等环境的应用程序性能监视器。 Apache SkyWalking 10.2.0及之前版本存在安全漏洞，该漏洞源于未正确处理脚本相关HTML标签，可能导致基本跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache SkyWalking | 0 ~ 10.2.0 | - |
|
II. Public POCs for CVE-2025-54057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54057
请登录查看更多情报信息。
Mailing List Discussions for CVE-2025-54057 (1)
-
https://lists.apache.org/thread/sl2x2tx8y007x0mo746yddx2lvnv9tcr vendor-advisory
Same Patch Batch · Apache Software Foundation · 2025-11-27 · 3 CVEs total
| CVE-2025-59454 | Apache CloudStack: Lack of user permission validation leading to data leak for few APIs | |
| CVE-2025-59302 | Apache CloudStack: Potential remote code execution on Javascript engine defined rules |
IV. Related Vulnerabilities
Same product: Apache SkyWalking
-
CVE-2026-85229
Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard -
CVE-2026-71216
Apache SkyWalking: PagerDuty alarm hook transmits the integr -
CVE-2026-30778
Apache SkyWalking: The SkyWalking OAP /debugging/config/dump -
CVE-2020-13921
Apache SkyWalking SQL注入漏洞 -
CVE-2020-9483
Apache SkyWalking SQL注入漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer -
CVE-2026-92899
Apache WSS4J: UsernameToken replay protection bypassed by re -
CVE-2026-92121
Apache WSS4J: WS-SecurityPolicy signature checks skipped in -
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing -
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Same weakness: CWE-80
-
CVE-2026-103585
attacker-controlled javascript license URL via XSS -
CVE-2026-103584
attacker-controlled javascript license URL via XSS -
CVE-2026-103439
Various rawParams() and escaped() updates to prevent XSS in -
CVE-2026-103438
Various rawParams() and escaped() updates to prevent XSS in -
CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
V. Comments for CVE-2025-54057
No comments yet