---
id: CVE-2025-52097
title: >-
  Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4
  allows an attacker to execute arbitrary code via reflecting un-sanitized input
  from query string parameters directly into the HTML response without proper
  out…
summary: >-
  Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4
  allows an attacker to execute arbitrary code via reflecting un-sanitized input
  from query string parameters directly into the HTML response without proper
  out…
severity: none
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T14:57:31.372Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-52097'
references:
  - url: 'http://instantasp.com'
  - url: 'http://instantforumnet.com'
  - url: 'https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md'
tags:
  - cve.org
  - exploit-available
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/rwilsonecs/CVE-2025-52097'
  checkedAt: '2026-10-16T15:12:21.579Z'
ingestedAt: '2026-10-16T15:11:47.116Z'
---

## Overview

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.