Medium severity · published Nov 21, 2025
CVE-2025-61949
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LogStare Collector (for Linux) · LogStare Inc.
2.4.1 and earlier · source: vendor
LC
LogStare Collector (for Windows) · LogStare Inc.
2.4.1 and earlier · source: vendor
LC
Logstare Collector · Secuavail
before 2.4.2 · source: NVD
Affected product
LC
LogStare Collector (for Linux)
LogStare Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61949
Third Party Advisory
https://jvn.jp/en/jp/JVN77560819/
Vendor Advisory
https://www.logstare.com/vulnerability/2025-001/
More from LogStare Collector (for Linux)
7.8
CVE-2025-58097
The installation directory of LogStare Collector is configured with incorrect access permissions
6.5
CVE-2025-62687
Cross-site request forgery vulnerability exists in LogStare Collector
4.3
CVE-2025-62189
LogStare Collector contains an incorrect authorization vulnerability in UserRegistration
2.7
CVE-2025-64299
LogStare Collector improperly handles the password hash data