CVE-2025-40722: Stored Cross-Site Scripting (XSS) vulnerability on Flatboard

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-03 · updated 2026-06-17
Weakness: CWE-79

Description

Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the replace parameter in /config.php/tags.

Affected products

Flatboard Pro Flatboard: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: Flatboard Pro Flatboard 3.2.2. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-stored-cross-site-scripting-xss-vulnerabilities-flatboard-pro

Get alerted when CVE-2025-40722 or the next vulnerability affects your stack