Medium severity4.3NVD Advisory· Published May 20, 2025· Updated Jun 17, 2026

CVE-2025-41228

Description

VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

VMware/Esxillm-fuzzy
VMware/Vcenter Serverllm-fuzzy
Broadcom Corporation/VMware vCenter Serverllm-create
Broadcom Corporation/VMware ESXillm-fuzzy

Patches

Vulnerability mechanics

References

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000