CVE-2025-52097 Details

A reflected cross-site scripting vulnerability has been identified in InstantASP Ltd, InstantForum.NET version 4.1.4. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue arises from unsanitized input in the 'hbhxg' query string parameter, which is reflected directly into the HTML response without proper output encoding. The vulnerability can be exploited by sending a crafted URL that injects a script payload, such as a JavaScript alert, which is then executed when the victim visits the URL.

No official patch is available, and the vendor is no longer in operation. It is recommended to implement proper input validation and output encoding for all reflected parameters, use context-appropriate encoding libraries or built-in ASP.NET encoding methods, and consider migrating to actively maintained forum platforms. As an interim mitigation, a Web Application Firewall (WAF) can be deployed to block common XSS payloads.