Live › vulnerability › CVE-2025-52097
Go to dashboardInstantForum.NET 4.1.4 reflects query string parameters into HTML responses without output encoding. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running InstantForum.NET version 4.1.4, where query string values are echoed into pages. Deployments on other versions or products outside this forum software can skip it. The sources do not say whether a later version fixes it.
No product ranges from the sources yet.
4.1.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding
This page as .md · .json · in your agent: get_signal("CVE-2025-52097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.