Cross Site Scripting Vulnerability in ExpressGateway by FreshFish
CVE-2025-9095
Key Information:
- Vendor
Expressgateway
- Status
- Vendor
- CVE Published:
- 17 August 2025
Badges
What is CVE-2025-9095?
A security flaw has been identified in ExpressGateway, impacting versions up to 1.16.10. The vulnerability resides in the library handling REST Endpoint processing, specifically in 'lib/rest/routes/users.js'. This flaw can lead to Cross Site Scripting (XSS) attacks, which might be executed remotely by an attacker. Although the vendor was made aware of this issue prior to public disclosure, there has been no communication or response. Users are advised to take precautions and monitor for any potential exploit attempts.
Affected Version(s)
express-gateway 1.16.0
express-gateway 1.16.1
express-gateway 1.16.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.