CVE-2025-23891

Summary

CVE-2025-23891 is a Cross-site Scripting (XSS) vulnerability affecting Yet Another Countdown, a web application from n/a through version 1.0.1. The issue lies in the improper neutralization of user input during web page generation. Attackers can exploit this vulnerability to inject malicious scripts into a web page viewed by other users, potentially stealing sensitive information or taking control of their sessions. DOM-Based XSS attacks, as in this case, can bypass Content Security Policy (CSP) mitigations, making them particularly dangerous. Users are strongly advised to update their Yet Another Countdown installation to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.