CVE-2025-39433

Summary

CVE-2025-39433 is a newly disclosed vulnerability affecting the Bknewsticker component of beke_ro. This issue combines both Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities. An attacker can exploit the CSRF flaw to perform unauthorized actions on behalf of a user, while the Stored XSS vulnerability allows the injection of malicious scripts into web pages viewed by other users. The Bknewsticker component, from an unknown version through 1.0.5, is reportedly impacted by these vulnerabilities. Users are advised to upgrade to a patch or mitigate the risks with appropriate security measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.