Low severity · published Feb 28, 2025
CVE-2025-22274
HTML injection in CyberArk Endpoint Privilege Manager
2.0
CVSS
0.5%
EPSS
No
On KEV
Description
It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Endpoint Privilege Manager · CyberArk
24.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22274
cert.pl
https://cert.pl/en/posts/2025/02/CVE-2025-22270/
cert.pl
https://cert.pl/posts/2025/02/CVE-2025-22270/
docs.cyberark.com
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
More from Endpoint Privilege Manager
9.8
CVE-2018-13052
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin
9.3
CVE-2025-22273
Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
7.8
CVE-2026-2914
CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs
7.8
CVE-2025-66374
CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task
7.8
CVE-2021-44049
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp…