What is CVE-2025-47929?

CVE-2025-47929 is a vulnerability in Dumbwareio Dumbdrop, classified under Cross-site Scripting. Published 2025-05-15.

Is CVE-2025-47929 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Dumbwareio Dumbdrop

CVE-2025-47929

DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.

Affected products

Dumbwareio Dumbdrop — versions < db27b25372eb9071e63583d8faed2111a2b79f1b

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

4rdr/proofs

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-47929?: CVE-2025-47929 is a vulnerability in Dumbwareio Dumbdrop, classified under Cross-site Scripting. Published 2025-05-15.
Is CVE-2025-47929 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.