CVE-2025-67025

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Jan 15, 2026

CISA due date

—

The record

Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section

Affected packages

Ecosystem	Package	Introduced	Fixed