Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attackers to embed malicious scripts in SVG files by sending a POST request to '/api/v1/user-avatar', which are then stored on the server and executed in the context of any user accessing the compromised resource.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-41085 Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attackers to em… https://www.cve.org/CVERecord?id=CVE-2025-41085
Post summary
The text discloses that CVE-2025-41085 is a stored XSS flaw in Apidog 2.7.15 caused by unsanitized SVG image uploads.
⚠️#INCIBEaviso | Cross-Site Scripting (XSS) almacenado en la plataforma web de #Apidog #CVE #CVE-2025-41085 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/cross-site-scripting-xss-almacenado-en-la-plataforma-web-de-apidog #AvisosDeSeguridad #TI #CNA #0day https://t.co/eyV5qi4ln0
Post summary
INCIBE issued an advisory about a stored XSS vulnerability in Apidog's web platform (CVE-2025-41085) but does not provide PoC, exploit, or patch details.
CVE-2025-41085 Stored XSS Vulnerability in Apidog 2.7.15 via Unsanitized SVG Image Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-41085
Post summary
Apidog 2.7.15 is vulnerable to stored XSS through unsanitized SVG image uploads, with no PoC, exploit, or patch information provided.