What is CVE-2025-1983?

CVE-2025-1983 is a vulnerability in Symfonia Ready, classified under Cross-site Scripting. Published 2025-04-16.

Is CVE-2025-1983 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Symfonia Ready

CVE-2025-1983

A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.

Affected products

Symfonia Ready_ — versions 7.0.0.0, 8.0.0.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

DojoSecurity/DojoSecurity
afine-com/research
vemusx/vemusx

References

cvd@cert.pl (third-party-advisory)
cvd@cert.pl (third-party-advisory)
cvd@cert.pl (product)

Frequently asked questions

What is CVE-2025-1983?: CVE-2025-1983 is a vulnerability in Symfonia Ready, classified under Cross-site Scripting. Published 2025-04-16.
Is CVE-2025-1983 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.