Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ss to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666 - https://github.com/n8n-io/n8n/pull/16405 - https://github.com/dudanogueira/n8n/commit/ca2f90c7fbaa1d661ade2f45d587d9469bc287e1 - https://github.com/n8n-io/n8n/commit/e5edc60e344924230baafb11fa1f0af788e9ca9a
CVE ID: CVE-2025-52555 State: PUBLISHED Published: 2025-06-26T20:21:05.594Z Last Updated: 2025-11-03T18:13:06.474Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: ceph Products: ceph Problem Types: CWE-269 Description: Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and avail
execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm - https://github.com/ceph/ceph/pull/60314
CVE ID: CVE-2025-52556 State: PUBLISHED Published: 2025-06-21T01:33:18.829Z Last Updated: 2025-06-23T15:13:49.905Z Vendors: trailofbits Products: rfc3161-client Problem Types: CWE-347 Description: rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp response signature verification logic. In particular, chain verification is performed against the TSR's embedded certificates up to the trusted root(s), but fails to verify the TSR's own signature against the timestamping leaf certificates. Consequently, vulnerable versions perform insufficient signature validation to properly consider a TSR v
f certificates. Consequently, vulnerable versions perform insufficient signature validation to properly consider a TSR verified, as the attacker can introduce any TSR signature so long as the embedded leaf chains up to some root TSA. This issue has been patched in version 1.0.3. There is no workaround for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/trailofbits/rfc3161-client/security/advisories/GHSA-6qhv-4h7r-2g9m - https://github.com/trailofbits/rfc3161-client/commit/724a184f953e3f171f85cb223871172b41b0d0dc
CVE ID: CVE-2025-52557 State: PUBLISHED Published: 2025-06-21T01:42:23.004Z Last Updated: 2025-06-23T17:41:29.958Z Vendors: Mail-0 Products: Zero Problem Types: CWE-1384 Description: Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85 - https://github.com/Mail-0/Zero/pull/1386 - https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f
CVE ID: CVE-2025-52558 State: PUBLISHED Published: 2025-06-23T20:52:24.343Z Last Updated: 2025-06-24T17:18:38.374Z Vendors: dgtlmoon Products: changedetection.io Problem Types: CWE-79 Description: changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hwpg-x5hw-vpv9 - https://g
chment: References: - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hwpg-x5hw-vpv9 - https://github.com/dgtlmoon/changedetection.io/commit/3d5a544ea674cfce517adcd498877a8d760d0931
CVE ID: CVE-2025-52559 State: PUBLISHED Published: 2025-07-02T19:31:12.064Z Last Updated: 2025-07-02T19:37:15.550Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-79 Description: Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/. Additio
This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-vgf2-vw4r-m663 - https://github.com/zulip/zulip/commit/175ec1f365b0db982d6eac9019701cbf6e8bc2f2 - https://github.com/zulip/zulip/commit/1a8429e338ff53bdcc4b42e7e71b6fffdd84fcd1 - https://github.com/zulip/zulip/commit/6608c8777254e73a4b540e5e1c4af92e680a55fc
CVE ID: CVE-2025-52560 State: PUBLISHED Published: 2025-06-24T02:56:26.589Z Last Updated: 2025-06-24T15:02:43.025Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-640 Description: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks
sword reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-2ch5-gqjm-8p92 - https://github.com/kanboard/kanboard/commit/bca2bd7ab95e7990e358fd35a7daf51a9c16aa75
CVE ID: CVE-2025-52561 State: PUBLISHED Published: 2025-06-23T21:00:13.699Z Last Updated: 2025-06-24T18:04:25.804Z Vendors: JuliaComputing Products: HTMLSanitizer.jl Problem Types: CWE-79 Description: HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could result in possible cross-site scripting (XSS) in any HTML that is sanitized with this library. This issue has been patched in version 0.2.1. A workaround involves adding the math and svg elements to th
this library. This issue has been patched in version 0.2.1. A workaround involves adding the math and svg elements to the whitelist manually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaComputing/HTMLSanitizer.jl/security/advisories/GHSA-3mj7-qxh9-6q4p - https://github.com/JuliaComputing/HTMLSanitizer.jl/pull/5 - https://github.com/JuliaComputing/HTMLSanitizer.jl/commit/0c3dc359e4a64c39cac609541945c0518feef040
CVE ID: CVE-2025-52562 State: PUBLISHED Published: 2025-06-23T20:48:17.456Z Last Updated: 2025-06-24T17:20:21.802Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ConvoyPanel Products: panel Problem Types: CWE-22, CWE-98 Description: Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files o
st with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ConvoyPanel/panel/security/advisories/GHSA-43g3-qpwq-hfgg - https://github.com/ConvoyPanel/panel/commit/f8d6202f3e4912b65dbd9f80ba625576944ab36c
CVE ID: CVE-2025-52565 State: PUBLISHED Published: 2025-11-06T20:02:58.513Z Last Updated: 2025-11-06T21:32:19.129Z Vendors: opencontainers Products: runc Problem Types: CWE-61, CWE-363 Description: runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-3
masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. Addit
r` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4 - https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398 - https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e - https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d - https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d
f4ac67d9840a043ebd2df5c68f36705d1d - https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a - https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64 - https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8 - https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
CVE ID: CVE-2025-52566 State: PUBLISHED Published: 2025-06-24T03:21:19.009Z Last Updated: 2025-06-24T21:49:53.200Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ggml-org Products: llama.cpp Problem Types: CWE-119, CWE-195 Description: llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been
ing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-7rxv-5jhh-j6xx - https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af
CVE ID: CVE-2025-52567 State: PUBLISHED Published: 2025-07-30T14:07:14.643Z Last Updated: 2025-07-30T19:27:34.141Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-918 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnr
t robust enough for certain specific cases. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-5mp6-mgmh-vrq7
CVE ID: CVE-2025-52568 State: PUBLISHED Published: 2025-06-24T03:06:12.471Z Last Updated: 2025-06-24T14:51:58.515Z Vendors: nekernel-org Products: nekernel Problem Types: CWE-20, CWE-770 Description: NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, disk image corruption, denial of service, and potential code execution. These issues stem from unchecked memory operations, unsafe typecasting, and improper input validation. This issue has been patched in version 0.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nekernel-org/nekernel/security/adviso
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nekernel-org/nekernel/security/advisories/GHSA-cmp2-5f6g-mw34 - https://github.com/nekernel-org/nekernel/pull/35 - https://github.com/nekernel-org/nekernel/pull/36 - https://github.com/nekernel-org/nekernel/commit/6506875ad0ab210b82a5c4ce227bf851508de17d - https://github.com/nekernel-org/nekernel/commit/6511afbf405c31513bc88ab06bca58218610a994
CVE ID: CVE-2025-52569 State: PUBLISHED Published: 2025-06-25T16:41:46.303Z Last Updated: 2025-06-25T17:55:48.517Z Vendors: JuliaWeb Products: GitHub.jl Problem Types: CWE-20, CWE-22 Description: GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide any string for the `repo_name` field. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on `api.github.com` that were not inten
dd path traversal patterns like `../` in the input to access any other endpoints on `api.github.com` that were not intended. Users should upgrade immediately to v5.9.1 or later to receive a patch. All prior versions are vulnerable. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaWeb/GitHub.jl/security/advisories/GHSA-jg9p-c3wh-q83x - https://github.com/JuliaWeb/GitHub.jl/pull/224
CVE ID: CVE-2025-52570 State: PUBLISHED Published: 2025-06-24T03:13:29.370Z Last Updated: 2025-06-24T14:42:51.785Z Vendors: mbuesch Products: letmein Problem Types: CWE-799, CWE-770 Description: Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. This issue has been patched in version 10.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
nections. This issue has been patched in version 10.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbuesch/letmein/security/advisories/GHSA-jpv7-p47h-f43j - https://github.com/mbuesch/letmein/commit/43207cd77580410d97165d1e3c07361ba6f3558c
CVE ID: CVE-2025-52571 State: PUBLISHED Published: 2025-06-24T20:07:24.328Z Last Updated: 2025-06-24T20:44:45.441Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: hikariatama Products: Hikka Problem Types: CWE-287 Description: Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hikariatama/Hikka/security/advisories
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hikariatama/Hikka/security/advisories/GHSA-vwpq-wm8w-44wf - https://github.com/hikariatama/Hikka/commit/9a0e4b1b387ef828c345c43d990421d5afcff5f6
CVE ID: CVE-2025-52572 State: PUBLISHED Published: 2025-06-24T20:10:18.861Z Last Updated: 2025-06-24T20:46:47.020Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: hikariatama Products: Hikka Problem Types: CWE-287 Description: Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenticated session: attacker can use his own Telegram account to gain RCE to the server by authorizing in the dangling web interface. 2. Web interface does have an authenticated session: due to insufficient warning in the authentication message, users were tempted to click "Allow" in
authenticated session: due to insufficient warning in the authentication message, users were tempted to click "Allow" in the "Allow web application ops" menu. This gave an attacker access not only to remote code execution, but also to Telegram accounts of owners. Scenario number 2 is known to have been exploited in the wild. No known patches are available, but some workarounds are available. Use `--no-web` flag and do not start userbot without it; after authorizing in the web interface, close the port on the server and/or start the userbot with `--no-web` flag; and do not click "Allow" in your helper bot unless it is your explicit action that needs to be allowed. Additional Analyst Notes: -
lick "Allow" in your helper bot unless it is your explicit action that needs to be allowed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hikariatama/Hikka/security/advisories/GHSA-7x3c-335v-wxjj - https://t.me/bbcode/9
CVE ID: CVE-2025-52573 State: PUBLISHED Published: 2025-06-26T14:08:56.100Z Last Updated: 2025-06-26T17:37:56.901Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: joshuayoes Products: ios-simulator-mcp Problem Types: CWE-78 Description: iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `ui_tap` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if
ver exposes the tool `ui_tap` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if concatenated with untrusted user input. LLM exposed user input for `duration`, `udid`, and `x` and `y` args can be replaced with shell meta-characters like `;` or `&&` or others to change the behavior from running the expected command `idb` to another command. When LLMs are tricked through prompt injection (and other techniques and attack vectors) to call the tool with input that uses special shell characters such as `; rm -rf /tmp;#` and other payload variations, the full command-line text will be interepted by the shell and result in other commands except of `ps` executin
iations, the full command-line text will be interepted by the shell and result in other commands except of `ps` executing on the host running the MCP Server. Version 1.3.3 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joshuayoes/ios-simulator-mcp/security/advisories/GHSA-6f6r-m9pv-67jw - https://github.com/joshuayoes/ios-simulator-mcp/commit/eb53a4f2cc8bbeb13e8d6d930f00167befcdb809 - https://github.com/joshuayoes/ios-simulator-mcp/blob/main/src/index.ts#L166-L207 - https://github.com/joshuayoes/ios-simulator-mcp/releases/tag/v1.3.3
CVE ID: CVE-2025-52574 State: PUBLISHED Published: 2025-06-24T02:52:11.889Z Last Updated: 2025-06-24T15:11:46.873Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: bocaletto-luca Products: elixir-system-monitor Problem Types: CWE-22 Description: SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bocaletto-luca/elixir-system-monitor/security/adviso
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/bocaletto-luca/elixir-system-monitor/security/advisories/GHSA-9vj4-rv7q-36qj - https://github.com/bocaletto-luca/elixir-system-monitor/commit/647a5525f6667a28f1133985213dd080ea11bb87
CVE ID: CVE-2025-52575 State: PUBLISHED Published: 2025-07-21T17:48:11.466Z Last Updated: 2025-07-21T18:09:07.329Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: espocrm Products: espocrm Problem Types: CWE-90 Description: EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory in
may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espocrm/espocrm/security/advisories/GHSA-rjm8-77fr-4f3v - https://github.com/espocrm/espocrm/commit/8649f1ac0ce714b2c31727bca3dd95d06e17337f
CVE ID: CVE-2025-52576 State: PUBLISHED Published: 2025-06-25T16:46:01.954Z Last Updated: 2025-06-25T17:55:05.784Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-203 Description: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected,