PT-2025-22356 · Rakessh · Ads24 Lite

Mika · Published 2025-05-21 · Updated 2026-01-04 · CVE-2025-23458

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rakessh Ads24 Lite versions through 1.0 Fortinet (affected versions not specified)

Description A Reflected Cross-site Scripting issue exists in Rakessh Ads24 Lite. This allows for improper neutralization of input during web page generation. Fortinet has addressed a zero-day that was actively exploited in attacks targeting FortiVoice, potentially leading to network breaches and remote access for attackers. These attacks have already impacted enterprises.

Recommendations Update Rakessh Ads24 Lite to a version later than 1.0. Update Fortinet FortiVoice to the latest available version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23458

Affected Products

Ads24 Lite

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-23458 · Security Note
• https://twitter.com/CVEnew/status/2005788750866178269 · Twitter Post
• https://vdp.patchstack.com/database/wordpress/plugin/wp-ad-management/vulnerability/wordpress-ads24-lite-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/40893 · Telegram Post
• https://twitter.com/cracbot/status/2007769011485098428 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-ad-management/vulnerability/wordpress-ads24-lite-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/wp-ad-management/vulnerability/wordpress-ads24-lite-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/ImamAlMahditech/status/1925168950859747486 · Twitter Post