CVE-2025-59988
Junos Space: Generate Report page is vulnerable to reflected cross-site script injection
Reported by juniper · Published October 9, 2025
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Junos Space | Juniper Networks | 24.1R4 |
| junos_space | juniper | 24.1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos Space | 0 |
| Juniper Networks | Junos Space | 0 |
Timeline
- Oct 9, 2025 CVE Published
- Oct 9, 2025 Coalition ESS Score (8 in total, the first dated here)
- Oct 10, 2025 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-59988
vulnetix vdb fixes CVE-2025-59988Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-59988/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart