CVE-2025-25148

Summary

CVE-2025-25148 is a newly disclosed vulnerability affecting the ElbowRobo software version 1.0.2 and earlier. This issue combines a Cross-Site Request Forgery (CSRF) weakness with the potential for Stored XSS attacks. An attacker can exploit the CSRF vulnerability to force a user into making unintended actions on the attacker's behalf, while the Stored XSS component allows the injection of malicious scripts into web pages viewed by other users. The consequences of this flaw can lead to unauthorized actions or data exposure, posing a significant threat to users of the affected software.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.