CVE-2025-23362

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-29 · updated 2026-06-17
Weakness: CWE-79

Description

The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.

Affected products

Rodrigue EXIF Viewer Classic: through 2.4.0

References

https://chromewebstore.google.com/detail/exif-viewer-classic/nafpfdcmppffipmhcpkbplhkoiekndck
https://exifviewers.com/
https://jvn.jp/en/jp/JVN05508012/

Get alerted when CVE-2025-23362 or the next vulnerability affects your stack