CVE-2025-40722

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Flatboard Pro versions prior to 3.2.2. The flaw is due to insufficient validation of user input supplied via the replace parameter in /config.php/tags. This allows an attacker to inject malicious scripts that are stored and later executed in the context of an administrator's browser.

Exploitation

Attackers must have low-privileged access to the application (e.g., authenticated as a registered user). By sending a crafted request to the vulnerable endpoint, the injected payload is stored. When an administrator views the tags configuration page, the script executes, potentially leading to session hijacking or further attacks.

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the affected administrator session. This could result in theft of session cookies, defacement, or other malicious actions within the application's security context.

Mitigation

The vulnerability has been fixed in Flatboard version 3.2.2. Users are advised to update immediately. No workarounds are available [1].