CVE-2025-24575

Summary

CVE-2025-24575 is a Cross-site Scripting (XSS) vulnerability affecting the HelloAsso application from version n/a through 1.1.11. Attackers can inject malicious code into the web pages generated by HelloAsso, which is then executed in users' browsers when they view the affected pages. This can lead to unauthorized access to user data, session hijacking, and other malicious activities. The vulnerability arises from the improper neutralization of user input, enabling attackers to inject and execute scripts in the context of the affected website. Users are advised to upgrade to the latest version of HelloAsso to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.