PT-2026-29211 · Unknown · Anon Proxy Server

Rafael Pedrero · Published 2026-03-31 · Updated 2026-03-31 · CVE-2025-41357

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Anon Proxy Server version 0.104

Description A Reflected Cross-Site Scripting (XSS) vulnerability exists that allows an attacker to execute JavaScript code in a victim's browser by sending a malicious URL. This can be used to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. The vulnerability affects the host parameter in the '/diagdns.php' API endpoint.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41357

Affected Products

Anon Proxy Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-41357 · Security Note
• https://twitter.com/incibe_cert/status/2038897676733890572 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-anon-proxy-server · Note