CVE-2025-52097

CVSS 5.4 (medium) · published 2026-10-16

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

Weakness: CWE-79

Source: NVD CVE-2025-52097

References

• http://instantasp.com
• http://instantforumnet.com
• https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md
• https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.