CVE-2025-24803

MobSF contains a Stored XSS in the iOS Dynamic Analyzer due to unsanitized CFBundleIdentifier input from Corellium in dynamic_analysis.html. An attacker can modify Info.plist to include special characters and trigger HTML context breaks when a malicious app is uploaded, enabling actions as users ...