CVE-2025-43924: Unicomsi Focal Point

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by an admin, allow stored XSS.

Affected products

• Unicomsi Focal Point: version 7.6.1 only

Published 2025-06-03. Last modified 2026-06-17.