Cross Site Scripting Vulnerability in Algernon by XYProto
CVE-2025-65754

6.1MEDIUM

Key Information:

Vendor

XYProto

Status
Algernon
Vendor
CVE Published:
10 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-65754?

The Cross Site Scripting vulnerability found in Algernon v1.17.4 allows attackers to execute arbitrary code by injecting malicious payloads into filenames. This exploit enables unauthorized access and manipulation of data, posing significant security risks to users. Developers and administrators are urged to apply the necessary patches to mitigate potential threats.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-65754
Created by Bnyt7

References

https://gist.github.com/Bnyt7/0faa90ff93c5d98093a0e29a1eb...
https://github.com/xyproto/algernon
https://github.com/Bnyt7/CVE-2025-65754

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.