CVE-2025-43924

Name of the Vulnerable Software and Affected Versions Unicom Focal Point version 7.6.1

Description A Cross Site Scripting issue was found. The val parameter in SettingController for the "/fp/admin/settings/loginpage" endpoint and the rootserviceurl parameter in FriendsController for the "/fp/admin/settings/friends" endpoint are vulnerable to stored XSS attacks when entered by an admin.

Recommendations For Unicom Focal Point version 7.6.1, consider disabling the val parameter in SettingController and the rootserviceurl parameter in FriendsController as a temporary workaround until a patch is available. Restrict access to the "/fp/admin/settings/loginpage" and "/fp/admin/settings/friends" endpoints to minimize the risk of exploitation. Avoid using the val and rootserviceurl parameters in the affected API endpoints until the issue is resolved.