CVE-2025-0458: Virtual Computer Vysual RH XSS Vulnerability

CVE-2025-0458 Overview

CVE-2025-0458 is a reflected cross-site scripting (XSS) vulnerability in Virtual Computer Vysual RH Solution 2024.12.1. The flaw resides in the Login Panel component and is triggered through the page parameter of the /index.php endpoint. Remote attackers can inject arbitrary script content without authentication or user interaction beyond clicking a crafted link. The exploit has been publicly disclosed. According to the disclosure, the vendor was contacted before publication but did not respond.

Critical Impact
Attackers can deliver malicious JavaScript through the login page, enabling session theft, credential harvesting, and phishing against authenticated Vysual RH users.

Affected Products

Virtual Computer Vysual RH Solution 2024.12.1
Component: Login Panel (/index.php)
Parameter: page

Discovery Timeline

2025-01-14 - CVE-2025-0458 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0458

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The /index.php script echoes the value supplied in the page request parameter back into the rendered HTML response without adequate output encoding or input sanitization. An attacker who convinces a victim to visit a crafted URL causes the browser to execute attacker-controlled JavaScript in the context of the Vysual RH Solution origin.

Because the Login Panel is the entry point for the application, injected scripts can manipulate the login form, exfiltrate credentials entered by the user, or redirect the browser to attacker-controlled infrastructure. The attack is network-reachable and requires no privileges. EPSS currently rates the exploitation probability at 0.414%.

Root Cause

The root cause is missing contextual output encoding on the page GET parameter before it is reflected into the HTML response generated by /index.php. User-controlled input is treated as trusted markup rather than data, which allows HTML and script tags to break out of the intended text context.

Attack Vector

Exploitation is remote and requires the victim to load a URL supplied by the attacker, typically delivered via phishing email, chat, or a malicious link on another site. When the victim opens the crafted link, the reflected payload executes in the victim's browser against the Vysual RH origin. See the VulDB advisory for the public disclosure record and the VulDB submission for the original submission details.

// No verified exploit code is published. The vulnerability is triggered
// by supplying script content in the `page` parameter of /index.php,
// which is reflected unescaped into the Login Panel HTML response.

Detection Methods for CVE-2025-0458

Indicators of Compromise

HTTP GET requests to /index.php containing page= values with HTML tag characters such as <, >, ", or script.
Web server access logs showing URL-encoded payloads (for example %3Cscript%3E) targeting the page parameter.
Referer chains indicating users arrived at the Vysual RH login page from unknown external domains or shortened URLs.

Detection Strategies

Deploy signatures on the web application firewall (WAF) or reverse proxy that flag script-like content in the page query parameter of /index.php.
Correlate authentication anomalies (failed logins, credential changes) with recent visits to /index.php from unusual referers.
Review browser security telemetry, including Content Security Policy (CSP) violation reports, for inline script execution on the login page.

Monitoring Recommendations

Enable verbose logging of query strings on the reverse proxy in front of Vysual RH Solution.
Alert on repeated inbound requests with encoded HTML metacharacters targeting the login endpoint from a single source IP.
Monitor endpoints of users who accessed suspicious Vysual RH URLs for follow-on credential misuse and session anomalies.

How to Mitigate CVE-2025-0458

Immediate Actions Required

Restrict access to the Vysual RH Solution Login Panel from untrusted networks using IP allowlists or VPN gating.
Deploy WAF rules that block or sanitize HTML metacharacters and script keywords in the page parameter of /index.php.
Instruct users to avoid clicking untrusted links referencing the Vysual RH login URL and to authenticate only from bookmarked entry points.

Patch Information

At the time of publication, no vendor patch or security advisory has been released. The disclosure notes that the vendor did not respond to outreach. Track the VulDB entry for CVE-2025-0458 for updates and contact Virtual Computer directly for remediation guidance.

Workarounds

Add a strict Content Security Policy (CSP) header on the Vysual RH web tier to block inline script execution.
Configure the reverse proxy to reject requests where the page parameter contains non-alphanumeric characters until a vendor fix is available.
Enable HttpOnly and Secure flags on session cookies to limit the impact of script execution against authenticated sessions.

bash

# Example NGINX rule to drop requests with suspicious `page` values
if ($arg_page ~* "(<|>|script|onerror|onload|javascript:)") {
    return 403;
}