Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
riting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-r2fw-9cw4-mj86 - https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680
m/vim/security/advisories/GHSA-r2fw-9cw4-mj86 - https://github.com/vim/vim/commit/586294a04179d855c3d1d4ee5ea83931963680b8
CVE ID: CVE-2025-53908 State: PUBLISHED Published: 2025-07-16T19:55:15.844Z Last Updated: 2025-07-18T14:21:44.885Z Vendors: rommapp Products: romm Problem Types: CWE-26 Description: RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rommapp/romm/security/advisories/GHSA-fx9g-xw4j-jwc3 - https://github.com/rommapp/romm/commit/7c94cb05e74ddb6a6af7b82320686c01754e9966 - https://github.com/rommapp/romm/commit/baa1a9759079c36e36a9f10c920c46b57d0b6151 - https://github.com/rommapp/romm/blob/4.0.0-beta.2/backend/endpoints/raw.py#L31
CVE ID: CVE-2025-53909 State: PUBLISHED Published: 2025-07-17T13:47:26.179Z Last Updated: 2025-07-17T19:54:59.975Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-1336 Description: mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI t
xpressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-8p7g-6cjj-wr9m - https://github.com/mailcow/mailcow-dockerized/commit/8c5f6c03214a4b2bdbf3c78932f860eee949012b
CVE ID: CVE-2025-53910 State: PUBLISHED Published: 2025-08-11T18:57:03.212Z Last Updated: 2025-08-11T19:37:44.454Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-53913 State: PUBLISHED Published: 2025-09-09T19:54:01.838Z Last Updated: 2025-09-12T13:54:40.859Z Vendors: Calix Products: GigaCenter ONT Problem Types: CWE-269 Description: Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/forty - https://www.calix.com - https://revers3everything.com/calix-case-five-0-days-five-cves/
CVE ID: CVE-2025-53914 State: PUBLISHED Published: 2025-09-09T19:59:27.381Z Last Updated: 2025-09-12T13:55:32.373Z Vendors: Calix Products: GigaCenter ONT Problem Types: CWE-269 Description: Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/sheivi - https://www.calix.com - https://revers3everything.com/calix-case-five-0-days-five-cves/
CVE ID: CVE-2025-53923 State: PUBLISHED Published: 2025-07-16T13:53:11.047Z Last Updated: 2025-07-22T14:59:08.801Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keyword parameter. If one persuades an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of public
an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-vvx2-m94x-f54m
CVE ID: CVE-2025-53924 State: PUBLISHED Published: 2025-07-16T13:55:57.980Z Last Updated: 2025-07-18T14:52:56.399Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the siteurl parameter. It is possible to inject malicious code into siteurl parameter resulting in Stored XSS. When someone clicks on the link the malicious code is executed. As of time of publication, no known patched versions exist
en someone clicks on the link the malicious code is executed. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-6rmq-5rjf-3fmx
CVE ID: CVE-2025-53925 State: PUBLISHED Published: 2025-07-16T14:21:42.272Z Last Updated: 2025-07-16T16:11:41.109Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload an .svg file that contains JavaScript code that is later executed. As of time of publication, no known patched versions exist. Additional Analyst Notes:
cript code that is later executed. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-x4wj-rhvg-hqr9
CVE ID: CVE-2025-53926 State: PUBLISHED Published: 2025-07-16T15:37:44.789Z Last Updated: 2025-07-16T15:55:28.326Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefore the victim must be persuaded into clicking into sent URL. As of time of publication, no known patched versions exist. Additional Analyst Notes:
aded into clicking into sent URL. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-g8jx-pj5p-fm3x
CVE ID: CVE-2025-53927 State: PUBLISHED Published: 2025-07-17T13:50:18.268Z Last Updated: 2025-07-17T19:56:23.111Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: MaxKB Problem Types: CWE-94 Description: MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because MaxKB only restricts the execution permissions of files in a specific directory. Therefore, an attacker can use the `shutil.copy2` method in Python to copy the command they want to execute to the executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue. Additional
executable directory. This bypasses directory restrictions and reverse shell. Version 2.0.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-5xhm-4j3v-87m4 - https://github.com/1Panel-dev/MaxKB/releases/tag/v2.0.0
CVE ID: CVE-2025-53928 State: PUBLISHED Published: 2025-07-17T13:56:02.915Z Last Updated: 2025-07-17T19:57:19.063Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: MaxKB Problem Types: CWE-94 Description: MaxKB is an open-source AI assistant for enterprise. Prior to versions 1.10.9-lts and 2.0.0, a Remote Command Execution vulnerability exists in the MCP call. Versions 1.10.9-lts and 2.0.0 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-38q2-4mm7-qf5h - https://github.com/1Panel-dev/MaxKB/releases/tag/v2.0.0
CVE ID: CVE-2025-53929 State: PUBLISHED Published: 2025-07-16T15:44:17.713Z Last Updated: 2025-07-18T14:51:18.662Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_cor.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `cor` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page `cadastro_pet.php` is accessed by users, posing a significant se
r and executed automatically whenever the affected page `cadastro_pet.php` is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mrwj-rf3q-3rqj
CVE ID: CVE-2025-53930 State: PUBLISHED Published: 2025-07-16T15:49:59.095Z Last Updated: 2025-07-18T14:50:20.976Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_especie.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `especie` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk
he server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-cxx4-6x69-vg4x
CVE ID: CVE-2025-53931 State: PUBLISHED Published: 2025-07-16T15:50:51.925Z Last Updated: 2025-07-18T14:49:52.828Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_raca.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `raca` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Vers
ver and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9mfp-wfmj-cg3j
CVE ID: CVE-2025-53932 State: PUBLISHED Published: 2025-07-16T15:54:04.235Z Last Updated: 2025-07-18T14:39:22.385Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `cadastro_adotante.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GH
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-3vfw-749q-qp6r
CVE ID: CVE-2025-53933 State: PUBLISHED Published: 2025-07-16T15:56:41.872Z Last Updated: 2025-07-18T14:38:26.812Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_enfermidade.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `nome` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security ris
the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6558-m8rp-5qg6
CVE ID: CVE-2025-53934 State: PUBLISHED Published: 2025-07-16T15:57:31.976Z Last Updated: 2025-07-18T14:37:28.343Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `control.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `descricao_emergencia` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security r
n the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gqwp-637v-v49v
CVE ID: CVE-2025-53935 State: PUBLISHED Published: 2025-07-16T16:00:03.026Z Last Updated: 2025-07-18T14:36:54.953Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `personalizacao_selecao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `id` parameter. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisorie
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5x6v-h459-xjqh
CVE ID: CVE-2025-53936 State: PUBLISHED Published: 2025-07-16T16:01:00.500Z Last Updated: 2025-07-18T14:36:16.980Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `personalizacao_selecao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `nome_car` parameter. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/adv
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-34vc-q923-v26p
CVE ID: CVE-2025-53937 State: PUBLISHED Published: 2025-07-16T16:03:15.150Z Last Updated: 2025-07-18T14:35:41.167Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the `/controle/control.php` endpoint, specifically in the `cargo` parameter, of WeGIA prior to version 3.4.5. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
bility of the database. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-j3qv-v3m7-73pj
CVE ID: CVE-2025-53938 State: PUBLISHED Published: 2025-07-16T16:04:51.218Z Last Updated: 2025-07-18T14:35:03.618Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-306 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the `/dao/verificar_recursos_cargo.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated users to access protected application functionalities and retrieve sensitive information by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue.
on by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj
CVE ID: CVE-2025-53940 State: PUBLISHED Published: 2025-07-24T22:23:58.389Z Last Updated: 2025-07-25T13:30:36.230Z Vendors: TryQuiet Products: quiet Problem Types: CWE-208 Description: Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token o
token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67 - https://github.com/TryQuiet/quiet/issues/2820#issue-3021080269 - https://github.com/TryQuiet/quiet/pull/2928
CVE ID: CVE-2025-53941 State: PUBLISHED Published: 2025-07-17T14:01:34.436Z Last Updated: 2025-07-17T14:21:36.942Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fedify-dev Products: hollo Problem Types: CWE-79 Description: Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fedify-dev/hollo/security/advisories/GHSA-w7gc-g3x7-hq8h - https://github.com/fedify-dev/hollo/commit/f9d25e
/github.com/fedify-dev/hollo/security/advisories/GHSA-w7gc-g3x7-hq8h - https://github.com/fedify-dev/hollo/commit/f9d25e10ba5406c27f9e87dfb01f75b6a52f2410 - https://github.com/fedify-dev/hollo/releases/tag/0.6.5
CVE ID: CVE-2025-53942 State: PUBLISHED Published: 2025-07-23T20:35:07.243Z Last Updated: 2025-07-23T20:49:29.415Z Vendors: goauthentik Products: authentik Problem Types: CWE-269 Description: authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers can still retain partial access to the system despite their accounts being deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can aut
being deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application. To workaround this issue, developers can add an expression policy to the user login stage on the respective authentication flow with the expression of return request.context["pending_user"].is_active. This modification ensures that the return statement only activates the user login stage when the user is active. This issue is fixed in versions authentik 2025.4.4 and 2025.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5
otes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5-7x42 - https://github.com/goauthentik/authentik/commit/7a4c6b9b50f8b837133a7a1fd2cb9b7f18a145cd - https://github.com/goauthentik/authentik/commit/c3629d12bfe3d32d3dc8f85c0ee1f087a55dde8f - https://github.com/goauthentik/authentik/commit/ce3f9e3763c1778bf3a16b98c95d10f4091436ab
CVE ID: CVE-2025-53943 State: PUBLISHED Published: 2025-07-16T16:07:52.120Z Last Updated: 2025-07-18T14:32:27.175Z Vendors: Death1Clown Products: VoidBot_open-source Problem Types: CWE-863 Description: VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permission checks are not properly enforced for certain administrative commands. This allows users without the required roles or privileges to execute sensitive commands such as `ban`, `kick`, or `shutdown`, potentially disrupting server operations. Version 1.0.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -