CVE-2025-7380

A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is subsequently displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.

• CWE-79

• https://www.asustor.com/security/security_advisory_detail?id=44

Published

Jul 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7371Okta On-Premises Provisioning (OPP) agents log certain user …6.8
• CVE-2025-7374The WP JobHunt plugin for WordPress, used by the JobCareer t…5.4
• CVE-2025-7375A denial-of-service (DoS) vulnerability was identified in Om…6.5
• CVE-2025-7376Windows Shortcut Following (.LNK) vulnerability in multiple …5.9
• CVE-2025-7378An improper Input Validation vulnerability allows injecting …6
• CVE-2025-7379A security bypass vulnerability allows exploitation via Reve…5.2
• CVE-2025-7381ImpactThis is an information disclosure vulnerability origin…5.3
• CVE-2025-7382A command injection vulnerability in WebAdmin of Sophos Fire…8.8
• CVE-2025-7383Padding oracle attack vulnerability in Oberon microsystem AG…5.9
• CVE-2025-7384The Database for Contact Form 7, WPforms, Elementor forms pl…9.8
• CVE-2025-7385Input from search query parameter in GOV CMS is not sanitize…9.3
• CVE-2025-7386Information exposure vulnerability in Hitachi Storage Naviga…6.8