CVE-2025-23922
CVSS 3.1 Score 10 of 10 (high)
Details
Published Jan 16, 2025
CWE ID 352
Summary
CVE-2025-23922 is a Cross-Site Request Forgery (CSRF) vulnerability affecting iSpring Embedder from an unknown version through 1.0. This issue enables an attacker to upload a web shell to a targeted web server, potentially gaining unauthorized access and control. The CSRF flaw allows the attacker to manipulate user sessions and execute malicious actions on behalf of the user. iSpring Embedder users are strongly advised to update to the latest version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.