CVE-2025-47204

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-47204
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/davidstutz/bootstrap-multiselect/releases Release Notes
https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:davidstutz:bootstrap_multiselect:1.1.2:*:*:*:*:*:*:*
History

09 Jul 2025, 02:02

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-13 16:15

Updated : 2025-07-09 02:02

NVD link : CVE-2025-47204

Mitre link : CVE-2025-47204

CVE.ORG link : CVE-2025-47204

JSON object : View

Products Affected

davidstutz

  • bootstrap_multiselect
CWE
CWE-352

Cross-Site Request Forgery (CSRF)