CVE-2025-24854CWE-79

Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin

Medium · published July 31, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

A carefully crafted request using the Image plugin could trigger an XSS

vulnerability on Apache JSPWiki, which could allow the attacker to

execute javascript in the victim's browser and get some sensitive

information about the victim.

Apache JSPWiki users should upgrade to 2.12.3 or later.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-31T08:43Z
EPSS history
Timeline
  • 31 JUL 08:43Z
    Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin
    cvelistv5