PT-2025-4494 · Unknown · Faktor Vier F4 Post Tree

Abdi Pranata · Published 2025-01-13 · Updated 2025-01-13 · CVE-2025-22499

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The vulnerable software is FAKTOR VIER F4 Post Tree, with versions ranging from n/a to 1.1.18. The vulnerability is an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting' (XSS), which allows Reflected XSS. This vulnerability can be exploited by attackers to inject malicious scripts into web pages, potentially affecting users of the F4 Post Tree software. There is a public reference to this vulnerability, identified as CVE-2025-22499. No information is provided about the number of Internet users that can be affected by the exploitation of this vulnerability. It is recommended to update the F4 Post Tree software to a version later than 1.1.18 to mitigate this vulnerability. #FAKTORVIER #F4PostTree #CrossSiteScripting #XSS #ReflectedXSS #CVE202522499 #ImproperNeutralization #InputValidation #WebSecurity #Vulnerability

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22499

Affected Products

Faktor Vier F4 Post Tree

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22499 · Security Note
• https://twitter.com/CVEnew/status/1878799441479536888 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1878880733751570553 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/f4-tree/vulnerability/wordpress-f4-post-tree-plugin-1-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/f4-tree/vulnerability/wordpress-f4-post-tree-plugin-1-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/15151 · Telegram Post