Cross-Site Scripting Vulnerability in ExpressGateway by FreshFish
CVE-2025-9096
Key Information:
- Vendor
Expressgateway
- Status
- Vendor
- CVE Published:
- 18 August 2025
Badges
What is CVE-2025-9096?
A cross-site scripting vulnerability exists in the ExpressGateway up to version 1.16.10, specifically within the REST Endpoint component found in the lib/rest/routes/apps.js file. This flaw allows attackers to manipulate input, potentially leading to unauthorized script execution in users' browsers. Exploitation can occur remotely, raising significant security concerns for deployments utilizing affected versions of the software. The issue was disclosed publicly, and while the vendor was notified, no response has been recorded. Organizations using ExpressGateway should assess their systems and update to the latest version to mitigate potential risks.
Affected Version(s)
express-gateway 1.16.0
express-gateway 1.16.1
express-gateway 1.16.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.