PT-2025-29541 · Unknown · Crosseditor4

Published 2025-07-15 · Updated 2025-07-30 · CVE-2025-7672

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CrossEditor4 versions 4.0.0.01 through 4.6.0.23

Description The improper default setting in the API modules of CrossEditor4 potentially allows Stored Cross-Site Scripting (XSS). Stored XSS is a type of security issue where malicious scripts are persistently stored on the target server and executed in the context of other users' browsers.

Recommendations CrossEditor4 versions prior to 4.6.0.23 should be updated.

Fix

XSS

Incorrect Default Permissions

Weakness Enumeration

CWE-79

CWE-276

Related Identifiers

CVE-2025-7672

Affected Products

Crosseditor4

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-7672 · Security Note
• https://t.me/cvetracker/27847 · Telegram Post
• https://t.me/cvenotify/128967 · Telegram Post
• https://twitter.com/CVEnew/status/1945026518813438146 · Twitter Post
• https://twitter.com/jmdevlabs/status/1950673157599137927 · Twitter Post
• https://namoeditor.co.kr/crosseditor-summary · Note