ExploitPublished
RomM 4.4.0 · XSS_CSRF Chain
Source Exploit-DB RSS Feed
0
Severity
MediumRated by Threat Radar
Data as of 22 Apr 2026, 07:07 UTC
What to do
AI-suggested
Until an official fix is available, consider implementing web application firewall rules to detect and block XSS and CSRF attack patterns, and apply standard CSRF protections such as anti-CSRF tokens.
Description
RomM 4.4.0 - XSS_CSRF Chain
Indicators of compromise
Exploit source code
# Exploit Title: RomM < 4.4.1 - XSS_CSRF Chain
# Date: 2025-12-03
# Exploit Author: He4am (https://github.com/mHe4am)
# Vendor Homepage: https://romm.app/
# Software Link: https://github.com/rommapp/romm (Docker: https://hub.docker.com/r/rommapp/romm)
# Version: < 4.4.1
# Tested on: Linux
# CVE: CVE-2025-65027
# -------------------
# Vulnerability: Chaining unrestricted file upload (XSS) + CSRF token reuse to bypass SameSite protection
# Impact: Admin account takeover
# Prerequisites:
# 1. A…References
Community reviews
Loading reviews…