{"id":"CVE-2025-52097","kind":"vulnerability","aliases":["CVE-2025-52097"],"related":[],"title":"InstantForum.NET: reflected XSS via unsanitized query string parameters","description":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding","summary":"InstantForum.NET 4.1.4 reflects query string parameters into HTML responses without output encoding. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net","instantforum.net","package","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Check whether InstantForum.NET is deployed and confirm the version is `4.1.4`\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T15:16:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T05:27:44+00:00","updated_at":"2026-10-25T05:27:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:27:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"InstantForum.NET: reflected XSS via unsanitized query string parameters","impact":"medium","summary":"InstantForum.NET 4.1.4 reflects query string parameters into HTML responses without output encoding. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.","category":"package","nicknames":[],"who_cares":["instantforum.net","asp.net","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"script runs in victim's browser session","analyst_note":"Confirm the fixed version and any vendor advisory for InstantForum.NET 4.1.4 at the NVD link (https://nvd.nist.gov/vuln/detail/CVE-2025-52097).","how_to_check":"- Check whether InstantForum.NET is deployed and confirm the version is `4.1.4`\n- unknown","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Sites running InstantForum.NET version 4.1.4, where query string values are echoed into pages. Deployments on other versions or products outside this forum software can skip it. The sources do not say whether a later version fixes it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3310,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':10A,13A '-52097':11A,14A '4.1.4':22B 'allow':62C 'arbitrari':67C 'asp.net':15B 'attack':34B,64C 'browser':51B 'code':68C 'craft':42B 'cross':53C 'cve':9A,12A 'direct':79C 'encod':32B,87C 'execut':66C 'get':36B 'host':20B 'html':28B,82C 'input':74C 'instantasp':58C 'instantforum.net':1A,16B,21B,60C 'link':43B 'ltd':59C 'open':40B 'output':31B,86C 'packag':17B 'paramet':8A,26B,78C 'proper':85C 'queri':6A,24B,76C 'reflect':2A,23B,70C 'respons':29B,83C 'run':45B 'sanit':73C 'script':46B,55C 'self':19B 'self-host':18B 'session':52B 'site':54C 'string':7A,25B,77C 'un':72C 'un-sanit':71C 'unsanit':5A 'v.4.1.4':61C 'via':4A,69C 'victim':38B,49B 'vulner':56C 'without':30B,84C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running InstantForum.NET version 4.1.4, where query string values are echoed into pages. Deployments on other versions or products outside this forum software can skip it. The sources do not say whether a later version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:16:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-52097","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52097","severity":null,"published_at":"2026-10-16T15:16:50+00:00","modified_at":"2026-10-16T19:56:15+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}