CVE-2025-52097

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-29
Weakness: CWE-79

Description

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

References

http://instantasp.com
http://instantforumnet.com
https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md
https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md

Get alerted when CVE-2025-52097 or the next vulnerability affects your stack