{"id":"CVE-2025-47204","aliases":["EUVD-2025-14385","GHSA-gv5r-9gxr-v74w"],"status":"published","title":"Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00443,"percentile":0.38979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352","CWE-79"],"published":"2025-05-13T00:00:00Z","modified":"2026-10-28T02:30:28Z","exploits":[{"source":"nuclei","id":"CVE-2025-47204","title":"Bootstrap Multiselect \u003c= 1.1.2 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47204.yaml"}],"fixes":[{"ecosystem":"npm","package":"bootstrap-multiselect","fixed_in":["2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bootstrap-multiselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"bootstrap-multiselect","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]}],"products":[{"vendor":"davidstutz","product":"bootstrap_multiselect"}],"references":[{"url":"https://github.com/davidstutz/bootstrap-multiselect/releases","tags":["Release Notes","package","web"]},{"url":"https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47204","tags":["advisory"]},{"url":"https://github.com/davidstutz/bootstrap-multiselect/issues/1286","tags":["web"]},{"url":"https://github.com/davidstutz/bootstrap-multiselect/pull/1287","tags":["web"]},{"url":"https://github.com/davidstutz/bootstrap-multiselect/commit/7da45ded9c82837a8eae9cb9dd3bd32a3dd1dc45","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gv5r-9gxr-v74w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47204.json","tags":["advisory"]},{"url":"https://github.com/davidstutz/bootstrap-multiselect","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-47204","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T00:00:00Z","modified":"2025-05-14T13:41:07.847Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-14385","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T00:00:00Z","modified":"2025-05-14T13:41:07Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:47.93917Z"}],"ghsa":[{"id":"GHSA-gv5r-9gxr-v74w","title":"Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T18:30:53Z","modified":"2026-02-26T21:59:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-352"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2025-47204","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T16:15:31.89Z","modified":"2026-06-17T09:27:35.227Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:07.176032Z"}],"osv":[{"id":"CVE-2025-47204","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-28T02:30:28.968076467Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-gv5r-9gxr-v74w","title":"Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data","description":"An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).","status":"published","published":"2025-05-13T18:30:53Z","modified":"2026-02-26T22:55:22.364053Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352","CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}