What is CVE-2025-9208?

CVE-2025-9208 is a medium-severity vulnerability in Opentext Web Site Management Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-02-19.

How severe is CVE-2025-9208?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Opentext Web Site Management Server

CVE-2025-9208

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored XSS. The vulnerability could execute malicious scripts on the client side when the download query parameter is removed from the file URL, allowing attackers to compromise user sessions and data. This issue affects Web Site Management Server: 16.7.X, 16.8, 16.8.1.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (10.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Opentext Web_site_management_server
Opentext™ Web Site Management Server — versions 16.7.x, 16.8, 16.8.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security@opentext.com (Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Exploit)

Frequently asked questions

What is CVE-2025-9208?: CVE-2025-9208 is a medium-severity vulnerability in Opentext Web Site Management Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-02-19.
How severe is CVE-2025-9208?: Medium severity. CVSS v3 base score is 5.4 out of 10.