{"id":"EUVD-2025-15170","enisaUuid":"8f248309-b9ba-3817-9363-cbc610114903","description":"Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.","datePublished":"May 15, 2025, 4:26:07 PM","dateUpdated":"Oct 9, 2026, 9:12:09 AM","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://www.herodevs.com/vulnerability-directory/cve-2025-1647\n","aliases":"CVE-2025-1647\nGHSA-q58r-hwc8-rm9j\n","assigner":"HeroDevs","epss":0.43,"enisaIdProduct":[{"id":"c0dd5432-58ac-3fbd-b63e-a286de0aef51","product":{"name":"Bootstrap","vendor":{"name":"Bootstrap"}},"product_version":"3.4.1 \u003c4.0.0"}],"enisaIdVendor":[{"id":"6819b531-1394-39fa-8c15-d0a24b83eb4b","vendor":{"name":"Bootstrap"}}],"enisaIdVulnerability":[{"id":"4ea10c14-6c4b-3525-a3b6-40d1b031c634","vulnerability":{"id":"CVE-2025-1647","description":"Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.","datePublished":"May 15, 2025, 4:26:07 PM","dateUpdated":"Oct 9, 2026, 9:12:09 AM","status":"PUBLISHED","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://www.herodevs.com/vulnerability-directory/cve-2025-1647\n","enisa_id":"EUVD-2025-15170\n","assigner":"HeroDevs","epss":0.43,"dataProcessed":"Nov 2, 2026, 7:14:20 AM","vulnerabilityProduct":[{"id":"f51bd5e1-250b-3fe5-9af8-e369f365aaa6","product":{"name":"Bootstrap","vendor":{"name":"Bootstrap"}},"product_version":"3.4.1 \u003c4.0.0"}],"vulnerabilityVendor":[{"id":"e6fbc082-826c-3b70-86b0-f813f0f1f61c","vendor":{"name":"Bootstrap"}}]}},{"id":"cf44d60e-2e43-3c59-9e16-0829207224fd","vulnerability":{"id":"GHSA-q58r-hwc8-rm9j","description":"Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components","datePublished":"May 15, 2025, 6:31:47 PM","dateUpdated":"Oct 9, 2026, 12:31:14 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-1647\nhttps://github.com/twbs/bootstrap\nhttps://lists.debian.org/debian-lts-announce/2025/06/msg00001.html\nhttps://lists.debian.org/debian-lts-announce/2026/10/msg00023.html\nhttps://www.herodevs.com/vulnerability-directory/cve-2025-1647\n","enisa_id":"EUVD-2025-15170\n","aliases":"CVE-2025-1647\nGHSA-q58r-hwc8-rm9j\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:54:59 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"7b901e30-ae72-3ceb-bd69-ecb17fe09614","advisory":{"id":"WID-SEC-W-2025-1072","description":"Bootstrap: Schwachstelle ermöglicht Cross-Site Scripting","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.","datePublished":"May 15, 2025, 10:00:00 PM","dateUpdated":"Jun 1, 2025, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1072.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-1072\n","aliases":"CVE-2025-1647\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"35599363-75de-394d-8630-532746e5012f","product":{"name":"4.0.0","vendor":{"name":"Illumina "}}},{"id":"36bd0cc4-a139-3901-8cfa-e67a5cf05751","product":{"name":"Open Source Bootstrap 4.0.0","vendor":{"name":"open source"}}},{"id":"4c49cea8-2438-3a71-afd5-734e4768e316","product":{"name":"Debian Linux","vendor":{"name":"Debian"}}},{"id":"5c8a0857-6f49-3026-8eec-c33fdf86ef0c","product":{"name":"Open Source Bootstrap \u003c4.0.0","vendor":{"name":"open source"}}},{"id":"f0c5b7cc-a2f8-3719-af11-5596cf0d4e96","product":{"name":"Bootstrap","vendor":{"name":"Bootstrap"}}}]}}]}