CVE-2025-52097

MediumCVSS 5.4/10Last modified Oct 29, 2026

Description

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-52109.8A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects un CVE-2025-521019.8linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the au CVE-2025-52119.8A vulnerability was found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This issue affects some unknown pr CVE-2025-52129.8A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been classified as critical. Affected is an unknown fu CVE-2025-521229.8Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbit CVE-2025-52139.8A vulnerability was found in projectworlds Responsive E-Learning System 1.0. It has been declared as critical. Affected by this vulnerabilit CVE-2025-521305.4File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticate CVE-2025-521316.4The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.CVE-2025-521326.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.CVE-2025-521336.4The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.CVE-2025-521363.0In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is t CVE-2025-52149.8A vulnerability was found in Kashipara Responsive Online Learing Platform 1.0. It has been rated as critical. Affected by this issue is some