Vulnerability · Published May 20, 2025 · Assigned by rapid7
CVE-2025-4951
Medium 4.6
In plain English
A medium-severity cross-site scripting in AppSpider Pro from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | AppSpider Pro | Below 7.5.018 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N