CVE-2025-28891

Summary

CVE-2025-28891 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the jazzigor price-calc application. This issue permits an attacker to execute Stored Cross-Site Scripting (XSS) attacks against unsuspecting users. The vulnerability exists in price-calc versions ranging from n/a to 0.6.3. An attacker can exploit this flaw by crafting a malicious request that, when executed by an affected user, could lead to the injection of malicious scripts into web pages they visit, potentially resulting in unintended actions or exposure of sensitive information. Users are strongly urged to update their price-calc software to a patched version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.