Project Name Validation Vulnerability in Rapid7 AppSpider Pro
CVE-2025-11195

3.3LOW

Key Information:

Vendor

Rapid7

Status
Appspider Pro
Vendor
CVE Published:
30 September 2025

What is CVE-2025-11195?

Rapid7 AppSpider Pro, prior to version 7.5.021, contains a vulnerability related to the validation of project names. An attacker can exploit this issue by altering the project name in the configuration file to replicate an existing name. This exploit arises from insufficient checks on the uniqueness of project names when modified externally, potentially leading to conflicts and unexpected behaviors in application security assessments. Rapid7 has addressed this vulnerability in version 7.5.021, emphasizing the importance of maintaining updated software to prevent such risks.

Affected Version(s)

AppSpider Pro 0 < 7.5.021

References

https://docs.rapid7.com/insight/releasenotes-2025sep/#app...

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thank you to Maksymilian Kubiak [Afine Team] for the responsible disclosure to Rapid7.
JSON
.
CVE-2025-11195 : Project Name Validation Vulnerability in Rapid7 AppSpider Pro