CVE-2025-23362

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 29, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-233637.4A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V1 CVE-2025-233648.4A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signing CVE-2025-233657.8A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to tr CVE-2025-233664.8A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input b CVE-2025-233676.5A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is sec CVE-2025-233688.1A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authenticat CVE-2025-233698.8An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing CVE-2025-23378.1A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the CVE-2025-233744.9Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information CVE-2025-233757.8Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged a CVE-2025-233764.4Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in CVE-2025-233773.4Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A hig