[ CVE-2025-52097 · Published 16 Oct 2026 ]
Vulnerability
Not scored yet
EPSS <1%No fix listed yet
[ Description ]Official description
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.