CVE-2025-11195
Low
Description
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.
SeverityLow
CVSS3.3
Exploit probability—
ProductRapid7 Appspider Pro
PublishedSep 30, 2025
First seenSep 30, 2025
Weakness typeCWE-20Improper input validationCWE-345CWE-345
How to fix
Update
- rapid7 appspider_pro7.5.021 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rapid7 appspider_pro | v < 7.5.021 | 7.5.021 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.