CVE-2025-48489

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to insufficient data validation and sanitization during data reception. This issue has been patched in version 1.8.180.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
freescout-help-desk	freescout	< 1.8.180

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqjf-f566-485jExploit, Vendor Advisory

Timeline

Published: May 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-48499.8A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function Clou CVE-2025-484906.6Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations d CVE-2025-484912.7Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. Th CVE-2025-484928.8GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit comp CVE-2025-484936.5The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes CVE-2025-484945.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cro CVE-2025-484955.4Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, a CVE-2025-484965.1Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under th CVE-2025-484975.1Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL whi CVE-2025-484987.5A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of CVE-2025-484995.3Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (CVE-2025-48506.3A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of