CVE-2025-4951mediumCWE-79

CVE-2025-4951: medium-severity vulnerability in Rapid7 AppSpider Pro

Published

Follow this CVE+ Monitor AppSpider Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.2%
Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Rapid7 · AppSpider Pro
Related CVEs — Rapid7 AppSpider Pro

In the same product, most dangerous first.

CVE-2017-5240—CVE-2017-5240EPSS 1.0%CVE-2017-5236—CVE-2017-5236EPSS 0.9%CVE-2017-5233—CVE-2017-5233EPSS 0.9%CVE-2025-11195LOWRapid7 AppSpider Project Name Validation BypassEPSS 0.1%