CVE-2025-23362

MEDIUM

EXIF Viewer Classic 2.3.2 and 2.4.0 - Cross-Site Scripting via EXIF Metadata

Title source: llm
STIX 2.1

Description

The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0035
EPSS Percentile 26.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
Rodrigue/EXIF Viewer Classic 2.4.0 and prior
Published Jan 29, 2025
Tracked Since Feb 18, 2026