CVE-2025-52180

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Oct 30, 2025

CISA due date

—

The record

Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed