CVE-2025-23039

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-23049.4A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' metho CVE-2025-230406.6GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository CVE-2025-230415.3Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fiel CVE-2025-230427.5Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arb CVE-2025-230448.1PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in use CVE-2025-230459.8Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on CVE-2025-230467.5GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authent CVE-2025-230476.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin`CVE-2025-230489.1In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using CVE-2025-230498.4Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.CVE-2025-23058.6A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to downloa CVE-2025-230503.1QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero).