PT-2026-29210 · Unknown · Anon Proxy Server

Rafael Pedrero · Published 2026-03-31 · Updated 2026-03-31 · CVE-2025-41356

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Anon Proxy Server version 0.104

Description A Reflected Cross-Site Scripting (XSS) vulnerability exists in Anon Proxy Server version 0.104. This allows an attacker to execute JavaScript code in a victim's browser by sending a malicious URL. This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. The vulnerability affects the host parameter in the '/diagconnect.php' API endpoint.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the host parameter in the '/diagconnect.php' endpoint to prevent the injection of malicious JavaScript code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41356

Affected Products

Anon Proxy Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-41356 · Security Note
• https://twitter.com/incibe_cert/status/2038897676733890572 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-anon-proxy-server · Note