1.0.1
CVE-2025-3788 is a cross-site scripting (XSS) vulnerability affecting baseweb JSite versions 1.0 through 1.0. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability resides in the /a/sys/user/save file, specifically in how it handles the 'Name' argument. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-3788 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious actions, including session hijacking, credential theft, and defacement of the website. The attacker could potentially steal sensitive user data, redirect users to malicious websites, or inject malware. Given the nature of XSS vulnerabilities, the impact can be significant, especially if the application handles sensitive information or is used by a large number of users.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact warrant attention. No known active campaigns targeting this specific vulnerability have been reported as of the publication date. Public proof-of-concept exploits are likely to emerge given the public disclosure.
Exploit Status
EPSS
0.16% (37% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-3788 is to upgrade to baseweb JSite version 1.0.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately possible, consider implementing input validation and sanitization on the 'Name' parameter in the /a/sys/user/save endpoint to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'Name' field and verifying that it is properly sanitized.
Update JSite to a version later than 1.0, if available, that fixes the Cross-Site Scripting (XSS) vulnerability. If no updates are available, consider disabling or replacing the affected component. Validate and sanitize user inputs, especially the 'Name' field, to prevent the injection of malicious code.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-3788 is a cross-site scripting (XSS) vulnerability in baseweb JSite versions 1.0 through 1.0, allowing attackers to inject malicious scripts via the 'Name' parameter in /a/sys/user/save.
You are affected if you are using baseweb JSite version 1.0. Upgrade to version 1.0.1 or later to mitigate the risk.
Upgrade to baseweb JSite version 1.0.1 or later. As a temporary workaround, implement input validation and sanitization on the 'Name' parameter.
While no active campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the likelihood of exploitation.
Refer to the baseweb project's official website or security advisories for the latest information and updates regarding CVE-2025-3788.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.