CVE-2025-41355
Reflected XSS in Anon Proxy Server Allows Session Hijacking
Publication date: 2026-03-31
Last updated on: 2026-04-07
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anonproxyserver | anon_proxy_server | 0.104 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Reflected Cross-Site Scripting (XSS) issue found in Anon Proxy Server version 0.104. It occurs in the 'port' and 'proxyPort' parameters of the '/anon.php' endpoint. An attacker can exploit this by sending a malicious URL to a victim, which causes the victim's browser to execute attacker-controlled JavaScript code.
The executed JavaScript can be used to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user without their consent.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser when you visit a specially crafted URL. This can lead to theft of sensitive information like session cookies, which may allow attackers to hijack your sessions.
Additionally, attackers could perform unauthorized actions on your behalf within the affected application, potentially compromising your account or data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104 allows attackers to execute malicious JavaScript in a victim's browser, potentially stealing sensitive user data such as session cookies or performing unauthorized actions on behalf of the user.
Such unauthorized access and data theft can lead to violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information from unauthorized access and breaches.
Therefore, this vulnerability could negatively impact compliance with these standards by exposing sensitive user data and failing to ensure adequate security controls.