CVE-2025-46497

Summary

CVE-2025-46497 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Navegg Analytics, from an unknown version up to 3.3.3. An attacker exploiting this issue can carry out Stored Cross-Site Scripting (XSS) attacks. The CSRF flaw allows an unauthenticated attacker to submit malicious requests on behalf of a vulnerable user, potentially stealing sensitive data or taking unauthorized actions. The Stored XSS vulnerability further magnifies the threat, enabling an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or account takeover.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.