CVE-2025-24854 — Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin

CVE-2025-24854

Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin PUBLISHED

Description (CNA)

A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache JSPWiki	affected 0 through 2.12.2

CWE

CWE-79

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/07/30/3