CVE-2025-48488

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.180.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484894.8FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scriptin CVE-2025-48499.8A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function Clou CVE-2025-484906.6Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations d CVE-2025-484912.7Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. Th CVE-2025-484928.8GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit comp CVE-2025-484936.5The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes CVE-2025-484945.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cro CVE-2025-484955.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, a CVE-2025-484965.1Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under th CVE-2025-484975.1Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL whi CVE-2025-484987.5A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of CVE-2025-484995.3Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (