{"id":"CVE-2025-52097","aliases":["EUVD-2025-211106","GHSA-f4qw-x63m-jfrp"],"status":"published","title":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker...","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00333,"percentile":0.26898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-16T00:00:00Z","modified":"2026-10-29T15:30:31Z","exploits":[{"source":"pocgithub","id":"rwilsonecs/CVE-2025-52097","title":"rwilsonecs/CVE-2025-52097","date":"2025-07-11","url":"https://github.com/rwilsonecs/CVE-2025-52097"}],"references":[{"url":"http://instantasp.com"},{"url":"http://instantforumnet.com"},{"url":"https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52097"},{"url":"https://github.com/advisories/GHSA-f4qw-x63m-jfrp"}],"sources":{"cve":[{"id":"CVE-2025-52097","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-29T12:06:57.435Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-211106","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-29T12:06:57Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:17.279653Z"}],"ghsa":[{"id":"GHSA-f4qw-x63m-jfrp","title":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker...","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","status":"published","published":"2026-10-16T15:38:46Z","modified":"2026-10-29T15:30:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:38.164928Z"}],"nvd":[{"id":"CVE-2025-52097","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","status":"published","published":"2026-10-16T15:16:50.36Z","modified":"2026-10-29T13:17:01.34Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:03.20248Z"}]}}