GHSA-72ww-4rcw-mc62

ghsaUSosv

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin

view advisory published 2025-07-31Licence: CC-BY-4.0

A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-24854US	—	0.47% (41st)	—	2025-07-31
A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's brow…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/07/30/3WEB
https://github.com/apache/jspwikiPACKAGE
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-24854ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan