Vulnerability · Published Sep 30, 2025 · Assigned by rapid7

CVE-2025-11195Rapid7 AppSpider Project Name Validation Bypass

Low 3.3

In plain English

A low-severity improper input validation in AppSpider Pro from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)<0.1%top 99.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.

Affected products (as reported)

Vendor	Product	Versions
Rapid7	AppSpider Pro	0 – before 7.5.021

Weakness: CWE-20, CWE-345 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://docs.rapid7.com/insight/releasenotes-2025sep/#application-security-insightappsec-and-appspider