CVE-2025-7380

published 2025-07-14

CVE-2025-7380: A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder…

Priority P4 24 medium 4.8 CVSS 4.0

AV N AC L AT N PR L UI A VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is subsequently displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data.
Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
asustor	adm	4.1.0 – 4.3.3.RH61	—
asustor	adm	5.0.0 – 5.0.0.RIN1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79