Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2025-7920: WinMatrix3 Web package: Unauthenticated attackers can run malicious code in users' browsers
CVE-2025-7920 · published 1 year ago
Summary
The WinMatrix3 Web package, used by Simopro Technology, has a security weakness that allows strangers to trick users into running unwanted code in their web browser, potentially stealing sensitive information or taking control of their computer. This can happen through fake emails or websites that appear legitimate. Users and administrators should update the package to the latest version to fix this issue.
Original advisory text
WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's ...
WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-7920 · NVD
Track software like this
Free during beta