CVE-2025-25908

Summary

CVE-2025-25908 is a stored cross-site scripting (XSS) vulnerability affecting tianti v2.3. This issue allows attackers to inject arbitrary web scripts or HTML into the coverImageURL parameter at /article/ajax/save. Successful exploitation could lead to unintended execution of malicious code in users' browsers, potentially resulting in session hijacking or data theft. Attackers can take advantage of this vulnerability by crafting specially designed inputs and manipulating the affected application to store and execute their malicious code. Users are strongly advised to patch their systems as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.