Cross-Site Scripting Vulnerability in ExpressGateway by FreshFish

CVE-2025-9096

What is CVE-2025-9096?

A cross-site scripting vulnerability exists in the ExpressGateway up to version 1.16.10, specifically within the REST Endpoint component found in the lib/rest/routes/apps.js file. This flaw allows attackers to manipulate input, potentially leading to unauthorized script execution in users' browsers. Exploitation can occur remotely, raising significant security concerns for deployments utilizing affected versions of the software. The issue was disclosed publicly, and while the vendor was notified, no response has been recorded. Organizations using ExpressGateway should assess their systems and update to the latest version to mitigate potential risks.

References