CyberRota Analysis
AI-GeneratedThe dataCycle data management system, specifically in the core processing module before version 25.07.3, is vulnerable to reflected DOM-based cross-site scripting (XSS) attacks due to improper handling of HTML in flash notifications. This flaw allows unauthenticated attackers to inject arbitrary HTML into public routes, potentially compromising user data and application integrity through crafted links. Organizations using affected versions of dataCycle should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash notifications on public routes and rely on the frontend toast component to inject that content into the DOM with `innerHTML`. This creates a reflected DOM XSS that can be delivered with a crafted link to a public page such as `/docs`. Because the vulnerable JavaScript is loaded by the normal application layout, the issue is not limited to a special debug page or an isolated admin-only view.