What’s Vulnerable › Vulnerabilities

CVE-2025-47204

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-13 · updated 2026-06-17
• Weakness: CWE-352

Description

An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).

Affected products

• Davidstutz Bootstrap Multiselect: 1.1.2

References

• https://github.com/davidstutz/bootstrap-multiselect/releases
• https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103

Get alerted when CVE-2025-47204 or the next vulnerability affects your stack