PT-2025-22125 · Rapid7 · Rapid7 Appspider Pro

Published 2025-05-20 · Updated 2025-12-11 · CVE-2025-4951

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Rapid7 AppSpider Pro versions prior to 7.5.018

Description: The issue is related to a stored cross-site scripting vulnerability in the ScanName field. Although the application prevents the inclusion of special characters within the ScanName field, this restriction can be bypassed by directly modifying the configuration file.

Recommendations: For versions prior to 7.5.018, update to version 7.5.018 or later to resolve the issue. As a temporary workaround, consider restricting direct modifications to the configuration file to minimize the risk of exploitation. Avoid using the ScanName field in a way that could introduce malicious scripts until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-4951

Affected Products

Rapid7 Appspider Pro

References · 8

• https://osv.dev/vulnerability/CVE-2025-4951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4951 · Security Note
• https://twitter.com/CVEnew/status/1924749315215597705 · Twitter Post
• https://docs.rapid7.com/release-notes/appspider/20250516 · Note
• https://t.me/cvetracker/24289 · Telegram Post
• https://t.me/cvenotify/123041 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1924759019090055336 · Twitter Post
• https://t.me/cveNotify/145486 · Telegram Post