CVE-2025-70846

Vulnerability

Overview

The aidigu application version v1.9.1 contains a stored cross-site scripting (XSS) vulnerability in the /tools/Password/add endpoint. The password input field fails to properly sanitize or escape user-supplied input, allowing an attacker to inject arbitrary HTML and JavaScript code that is stored by the application [1].

Exploitation

Vectors

To exploit this vulnerability, an attacker must be able to submit a crafted payload via the password field during the password creation process. No special privileges or network position beyond normal user access to the application are required. The injected script is stored and subsequently executed in the browser of any user viewing the affected page [1].

Impact

Successful exploitation results in the execution of attacker-controlled scripts in the context of the victim's user session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites, depending on the attacker's objectives [1].

Mitigation

Status

The vulnerability has been addressed in a subsequent release of aidigu. Users are strongly advised to upgrade to a patched version. For version v1.9.1, no official workaround has been provided other than applying the update [1].