CVE-2026-25688

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-87

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	<= 2.0.0

References

https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5qMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/09/7Mailing List, Third Party Advisory

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256896.5An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDe CVE-2026-25696.4The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via P CVE-2026-256906.5An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through CVE-2026-256916.7A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,CVE-2026-256996.1Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through CVE-2026-257007.2Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previou CVE-2026-257017.0An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like CVE-2026-257029.8A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules ap CVE-2026-257037.3NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data co CVE-2026-257045.8A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in cosmic-greeter can allow an attac CVE-2026-257058.4A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extens CVE-2026-257067.5Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Ac