CVE-2025-48486 — FreeScout Vulnerable to Stored XSS

CVE-2025-48486

FreeScout Vulnerable to Stored XSS PUBLISHED

Description (CNA)

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of input validation and sanitization in both \Session::flash and __, allowing user input to be executed without proper filtering. This issue has been patched in version 1.8.180.

Affected (CNA)

Vendor / product	Versions
freescout-help-desk / freescout	affected < 1.8.180

CWE

CWE-79

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9jpm-xrpc-cv66

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.