{"id":72864,"date":"2025-11-03T20:05:56","date_gmt":"2025-11-03T16:35:56","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-10280-incorrect-content-type-cross-site-scripting-vulnerability\/"},"modified":"2025-11-03T20:05:56","modified_gmt":"2025-11-03T16:35:56","slug":"cve-2025-10280-incorrect-content-type-cross-site-scripting-vulnerability","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-10280-incorrect-content-type-cross-site-scripting-vulnerability\/","title":{"rendered":"CVE-2025-10280 &#8211; Incorrect Content Type Cross-Site Scripting Vulnerability"},"content":{"rendered":"<p>CVE ID : CVE-2025-10280<\/p>\n<p>Published :  Nov. 3, 2025, 4:35 p.m. | 52\u00a0minutes ago<\/p>\n<p>Description : IdentityIQ<br \/>\n8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and<br \/>\nall 8.3 patch levels prior to 8.3p6, and all prior versions allows some<br \/>\nIdentityIQ web services that provide non-HTML content to be accessed via a URL<br \/>\npath that will set the Content-Type to HTML allowing a requesting browser to<br \/>\ninterpret content not properly escaped to prevent Cross-Site Scripting (XSS).<\/p>\n<p>Severity: 7.1 | HIGH<\/p>\n<p>Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-10280 Published : Nov. 3, 2025, 4:35 p.m. | 52\u00a0minutes ago Description : IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p6, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-72864","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=72864"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72864\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=72864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=72864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=72864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}