CVE-2025-48875: FreeScout Vulnerable to Stored XSS
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of lastname and firstname during profile data updates allows for the injection of arbitrary JavaScript code, which will be executed in a flesh-message when the data is deleted, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.181.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48875?
CVE-2025-48875 has a severity level that indicates a critical risk due to potential JavaScript code injection.
How do I fix CVE-2025-48875?
To fix CVE-2025-48875, upgrade your FreeScout installation to version 1.8.181 or later.
What type of vulnerability is CVE-2025-48875?
CVE-2025-48875 is a cross-site scripting (XSS) vulnerability that allows injection of arbitrary JavaScript code.
What versions of FreeScout are affected by CVE-2025-48875?
FreeScout versions prior to 1.8.181 are affected by CVE-2025-48875.
Is my data safe if I am using an affected version of FreeScout with CVE-2025-48875?
If you're using an affected version, your data may not be safe, as attackers could exploit the vulnerability to execute harmful scripts.