VulnerabilityAnalyzed

CVE-2025-4951

Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field.

MEDIUM 4.6EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018

CVSS 3.1: 4.6 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: rapid7/appspider pro
Source: cve@rapid7.com

References

https://docs.rapid7.com/release-notes/appspider/20250516/Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.