What’s Vulnerable › Vulnerabilities

CVE-2025-55473

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-02 · updated 2026-06-17
• Weakness: CWE-79

Description

Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in the /ip.php endpoint, which processes and displays the X-Forwarded-For HTTP header without proper sanitization or output encoding. This allows an attacker to inject malicious JavaScript code that will execute in visitor browsers.

References

• https://cyber-ducky.com/xss-found-in-asian-arts-talent-foundation-2/
• https://github.com/AATF/aatf.us
• https://hub.docker.com/r/aatf/aatf.us

Get alerted when CVE-2025-55473 or the next vulnerability affects your stack