CVE-2025-48488CWE-79

FreeScout Vulnerable to Stored XSS

Medium · published May 30, 2025

CVSS v4.0
4.6
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.180.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-30T06:30Z
EPSS history
Timeline
  • 30 MAY 06:30Z
    FreeScout Vulnerable to Stored XSS
    cvelistv5