deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60782
Published: 2025-10-02
Description: PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics.php). Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gold-textbook-8ff.notion.site/php-education-management-Background-storage-xss-25985e97f35380db9d38e7d0fbb408d6?pvs=73; https://gold-textbook-8ff.notion.site/php-education-management-Background-storage-xss-25985e97f35380db9d38e7d0fbb408d6
CVE: CVE-2025-61087
Published: 2025-10-02
Description: SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61087; https://www.linkedin.com/in/shuvo-ahmed-sanin/; https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61087
CVE: CVE-2025-61096
Published: 2025-10-02
Description: PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61096; https://www.linkedin.com/in/shuvo-ahmed-sanin/
CVE: CVE-2025-56154
Published: 2025-10-02
Description: htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/akinerkisa/28e97fa132b1a98cff5d05a79b437901; https://github.com/danpros/htmly/releases/tag/v3.0.9#:~:text=Security%20fixes%20found%20in%20version%203.0.8; https://pastebin.com/dVityKmU
CVE: CVE-2025-56161
Published: 2025-10-02
Description: YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gitee.com/xany/yoshop2.0; https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56161.md
CVE: CVE-2025-56162
Published: 2025-10-02
Description: YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/xany/yoshop2.0; https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56162.md
CVE: CVE-2025-57305
Published: 2025-10-02
Description: VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://vitaracharts.com; https://www.mattz.io/posts/cve-2025-57305/
CVE: CVE-2025-60660
Published: 2025-10-02
Description: Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://drive.google.com/file/d/1YTKUiYXMsaAEoasx7xbQxy2tsrC5E3Ew/view?usp=sharing
CVE: CVE-2025-60662
Published: 2025-10-02
Description: Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://drive.google.com/file/d/1-XpZmT_Yw5JtygQJ6HZBRnC5IjlAnLQO/view?usp=sharing
CVE: CVE-2025-34208
Published: 2025-10-02
Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SHA-1. The hashing is performed via PHP's `hash()` function in multiple files (server_write_requests_users.php, update_database.php, legacy/Login.php, tests/Unit/Api/IdpControllerTest.php). No per-user salt is used and the fast hash algorithms are unsuitable for password storage. An attacker who obtains the password database can recover cleartext passwords via offline dictionary or rainbow table attacks. The vulnerable code also contains logic that migrates legacy SHA-1 hashes to SHA-512 on login, further exposing users still on the old hash. This vulnerability was partially resolved, but still present within the legacy authentication platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-759
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-incorrect-encryption-algorithms-password
CVE: CVE-2025-34210
Published: 2025-10-02
Description: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in cleartext files that are world-readable. Any local user - or any process that can read the host filesystem - can retrieve all of these secrets in plain text, leading to credential theft and full compromise of the appliance. The vendor does not consider this to be a security vulnerability as this product "follows a shared responsibility model, where administrators are expected to configure persistent storage encryption."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-256
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-readable-passwords
CVE: CVE-2025-59403
Published: 2025-10-02
Description: The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack, and /adb/enable. This results in multiple impacts including denial of service (DoS) via /reboot, information disclosure via /logs, and remote code execution (RCE) via /adb/enable. The latter specifically results in adb being started over TCP without debugging confirmation, providing an attacker in the LAN/WLAN with shell access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/; https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf; https://www.flocksafety.com/products
CVE: CVE-2025-59405
Published: 2025-10-02
Description: The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/; https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf; https://www.flocksafety.com/products
CVE: CVE-2025-59406
Published: 2025-10-02
Description: The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-319
References: https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/; https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf; https://www.flocksafety.com/products
CVE: CVE-2025-59407
Published: 2025-10-02
Description: The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/; https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf; https://www.flocksafety.com/products
CVE: CVE-2025-59409
Published: 2025-10-02
Description: Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://gainsec.com/2025/09/27/fly-by-device-2-the-falcon-sparrow-gated-wireless-rce-camera-feed-dos-information-disclosure-and-more/; https://gainsec.com/wp-content/uploads/2025/09/Root-from-the-Coop-Device-3_-Root-Shell-on-Flock-Safetys-Bravo-Compute-Box-GainSec.pdf; https://www.flocksafety.com/products
CVE: CVE-2025-60661
Published: 2025-10-02
Description: Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-121
References: https://drive.google.com/file/d/10bqMY1XighOBZ5D_Q8GtWFwhmxSN2GJw/view?usp=sharing
CVE: CVE-2025-60663
Published: 2025-10-02
Description: Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://drive.google.com/file/d/1co536tsEdPANFHsvhBvay0_FOMCA4R6r/view?usp=sharing
CVE: CVE-2025-56019
Published: 2025-10-02
Description: An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy (BLE) without authentication. Once an unauthorized connection is established, legitimate applications are unable to connect, causing a denial of service. The attack requires proximity to the device, making it exploitable from an adjacent network location.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-277
References: https://github.com/Yashodhanvivek/Agatsa-EasyTouch-Plus---CVE-2025-56019/blob/main/input.md
CVE: CVE-2025-32942
Published: 2025-10-02
Description: SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.
CVSS Score: 7.2 (HIGH)
CWE: CWE-670
References: https://info.ssh.com/tectia-vulnerability-cve-2025-32942
CVE: CVE-2025-49090
Published: 2025-10-02
Description: The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-642
References: https://github.com/Nheko-Reborn/nheko/issues/1931; https://github.com/matrix-org/matrix-spec/releases/tag/v1.16; https://matrix.org/blog/2025/08/project-hydra-improving-state-res/
CVE: CVE-2025-54315
Published: 2025-10-02
Description: The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
CVSS Score: 7.1 (HIGH)
CWE: CWE-837
References: https://github.com/matrix-org/matrix-spec/releases/tag/v1.16; https://matrix.org/blog/2025/08/project-hydra-improving-state-res/
CVE: CVE-2025-59835
Published: 2025-10-02
Description: LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.
CWE: CWE-23, CWE-434
References: https://github.com/langbot-app/LangBot/pull/1691; https://github.com/langbot-app/LangBot/releases/tag/v4.3.5; https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4
CVE: CVE-2025-10653
Published: 2025-10-02
Description: An unauthenticated debug port may allow access to the device file system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-288
References: https://support.raise3d.com/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-01
CVE: CVE-2025-54086
Published: 2025-10-02
Description: CVE-2025-54086 is an excess permissions vulnerability in the
Warehouse component of Absolute Secure Access prior to version 14.10. Attackers
with access to the local file system can read the Java keystore file. The
attack complexity is low, there are no attack requirements, the privileges
required are low and no user interaction is required. Impact to confidentiality
is low, there is no impact to integrity or availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54086
CVE: CVE-2025-54087
Published: 2025-10-02
Description: CVE-2025-54087 is a server-side request forgery
vulnerability in Secure Access prior to version 14.10. Attackers with
administrative privileges can publish a crafted test HTTP request originating
from the Secure Access server. The attack complexity is high, there are no
attack requirements, and user interaction is required. There is no direct
impact to confidentiality, integrity, or availability. There is a low severity
subsequent system impact to integrity.
CVSS Score: 2.6 (LOW)
CWE: CWE-918
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54087
CVE: CVE-2025-61595
Published: 2025-10-02
Description: MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2.
CWE: CWE-400, CWE-770
References: https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4; https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69
CVE: CVE-2025-61603
Published: 2025-10-02
Description: WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/84958eed73741a544859eea297908db3b83b3833; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v8hm-pq8g-c7j4; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v8hm-pq8g-c7j4
CVE: CVE-2025-61604
Published: 2025-10-02
Description: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/839de09798f61c9a76043bb2c4b3063d310c5aed; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-59hm-4m9h-ch3m; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-59hm-4m9h-ch3m
CVE: CVE-2025-54088
Published: 2025-10-02
Description: CVE-2025-54088 is an open-redirect vulnerability in Secure
Access prior to version 14.10. Attackers with access to the console can
redirect victims to an arbitrary URL. The attack complexity is low, attack
requirements are present, no privileges are required, and users must actively
participate in the attack. Impact to confidentiality is low and there is no
impact to integrity or availability. There are high severity impacts to
confidentiality, integrity, availability in subsequent systems.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54088
CVE: CVE-2025-54089
Published: 2025-10-02
Description: CVE-2025-54089 is a cross-site scripting vulnerability in versions
of secure access prior to 14.10. Attackers with administrative access to the
console can interfere with another administrator’s access to the console. The
attack complexity is low; there are no attack requirements. Privileges required
to execute the attack are high and the victim must actively participate in the
attack sequence. There is no impact to confidentiality or availability, there
is a low impact to integrity.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54089
CVE: CVE-2025-61605
Published: 2025-10-02
Description: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/176733543c9b6762bef5ddec7c9c555f76fafa1d; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8963-9833-gpx7; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8963-9833-gpx7
CVE: CVE-2025-61606
Published: 2025-10-02
Description: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This issue is fixed in version 3.5.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/85051ad14b1e7fa14116e74a90c0bd5480b2ec84; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m64v-hm7q-33wr; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m64v-hm7q-33wr
CVE: CVE-2025-61665
Published: 2025-10-02
Description: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-287
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/828f23a6a760a52b8bb8bfd583cc2b23c42da51e; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f
CVE: CVE-2025-61600
Published: 2025-10-02
Description: Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-789
References: https://github.com/stalwartlabs/stalwart/commit/a8e631e881bded[PII_REDACTED]f18e02ca94a4e677; https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.4; https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr
CVE: CVE-2025-61666
Published: 2025-10-02
Description: Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1-  6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.
CWE: CWE-22
References: https://github.com/traccar/traccar/blob/v6.8.1/src/main/java/org/traccar/web/DefaultOverrideServlet.java; https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87; https://projectblack.io/blog/jetty-addpath-lfi
CVE: CVE-2025-61668
Published: 2025-10-02
Description: Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.
CWE: CWE-476, CWE-754
References: http://github.com/plone/volto/releases/tag/18.27.2; https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c; https://github.com/plone/volto/pull/7412
CVE: CVE-2025-10895
Published: 2025-10-02
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.