CVE-2025-57769

MediumCVSS 6.1/10Last modified Oct 19, 2026

Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-1021

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-57777.5Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN,CVE-2025-577705.3The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.CVE-2025-577718.1Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly hand CVE-2025-577729.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in Dat CVE-2025-577739.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filte CVE-2025-577747.8There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilen CVE-2025-577757.8There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vul CVE-2025-577767.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with D CVE-2025-577777.8There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. CVE-2025-577787.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file CVE-2025-57789.8A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown func CVE-2025-577808.8A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges.