Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Grafana Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-41117 - Vulnerability Database
Grafana

Grafana Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-41117

Medium
Reference: CVE-2025-41117
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-41117
Title: Grafana Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Stack traces in Grafana39s Explore Traces view can be rendered as raw HTML and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected Jaeger gRPC and Tempo do not appear affected whatsoever.