CVE-2025-50891

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-19 · updated 2026-06-17
Weakness: CWE-79

Description

The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a customer does not need to take any action to update locally installed software (such as Adform Site Tracking 1.1).

Affected products

Adform server-side backend for Site Tracking: before 2025-08-28 — fixed in 2025-08-28

How to fix

Upgrade to a fixed version: Adform server-side backend for Site Tracking 2025-08-28. Check the vendor advisory for mitigations.

References

https://github.com/nikolas-ch/CVEs/blob/main/AdformTracking_ReflectedXSS/AdformTracking_ReflectedXSS.txt
https://github.com/nikolas-ch/CVEs/tree/main/AdformTracking_ReflectedXSS
https://www.adformhelp.com/hc/en-us/categories/9738364537233-Adform-Site-Tracking

Get alerted when CVE-2025-50891 or the next vulnerability affects your stack