CVE-2025-23575

Summary

CVE-2025-23575 is a Cross-site Scripting (XSS) vulnerability affecting NotFound DX Sales CRM. The issue arises due to improper neutralization of user inputs during web page generation. An attacker can exploit this flaw to inject malicious scripts into the CRM system, potentially gaining unauthorized access to user data or taking control of their sessions. This vulnerability poses a significant risk, particularly for organizations using NotFound DX Sales CRM versions from n/a through 1.1. It is crucial that affected users apply necessary patches or upgrades as soon as possible to mitigate the risk of potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.