CVE-2025-47204

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-47204
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/davidstutz/bootstrap-multiselect/releases Release Notes
https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:davidstutz:bootstrap_multiselect:1.1.2:*:*:*:*:*:*:*
History

09 Jul 2025, 02:02

Type Values Removed Values Added
References () https://github.com/davidstutz/bootstrap-multiselect/releases - () https://github.com/davidstutz/bootstrap-multiselect/releases - Release Notes
References () https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103 - () https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103 - Patch
CPE cpe:2.3:a:davidstutz:bootstrap_multiselect:1.1.2:*:*:*:*:*:*:*
First Time Davidstutz bootstrap Multiselect
Davidstutz

14 May 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
Summary
  • (es) Se descubrió un problema en post.php en bootstrap-multiselect (también conocido como Bootstrap Multiselect) 1.1.2. Un script PHP en el código fuente reproduce datos POST arbitrarios. Si un desarrollador adopta esta estructura de forma generalizada en una aplicación en vivo, podría generar una vulnerabilidad de Cross-Site Scripting (XSS) reflejado, explotable mediante Cross-Site Request Forgery (CSRF).
CWE CWE-352

13 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-13 16:15

Updated : 2025-07-09 02:02

NVD link : CVE-2025-47204

Mitre link : CVE-2025-47204

CVE.ORG link : CVE-2025-47204

JSON object : View

Products Affected

davidstutz

  • bootstrap_multiselect
CWE
CWE-352

Cross-Site Request Forgery (CSRF)