deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-25013
Published: 2025-04-08
Description: Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://discuss.elastic.co/t/elastic-defend-8-17-3-security-update-esa-2025-05/376921
CVE: CVE-2025-32460
Published: 2025-04-09
Description: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb; https://issues.oss-fuzz.com/issues/406320404; https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/
CVE: CVE-2025-32461
Published: 2025-04-09
Description: wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-1336
References: https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0; https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1; https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd[PII_REDACTED]6ecd6afd868f3d7877a
CVE: CVE-2025-29988
Published: 2025-04-09
Description: Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/en-in/000283859/dsa-2025-088
CVE: CVE-2025-32464
Published: 2025-04-09
Description: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1025
References: https://github.com/haproxy/haproxy/commit/3e3b9eebf871510aee36c3a3336faac2f38c9559; https://lists.debian.org/debian-lts-announce/2025/04/msg00031.html
CVE: CVE-2025-3100
Published: 2025-04-09
Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/src/File/Helper/File.php#L56; https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=cve
CVE: CVE-2024-6857
Published: 2025-04-09
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/97636602-2dd0-465b-b6dc-acb42147edb3/
CVE: CVE-2024-6860
Published: 2025-04-09
Description: The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1d09d3dd-aa49-4ff1-80e7-6d176e378916/
CVE: CVE-2024-8243
Published: 2025-04-09
Description: The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/8e1e2d8d-41aa-49bc-95d5-dae75be788d5/
CVE: CVE-2025-3442
Published: 2025-04-09
Description: This vulnerability exists in TP-Link Tapo H200 V1  IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.
CWE: CWE-312
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0072
CVE: CVE-2025-20952
Published: 2025-04-09
Description: Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-23407
Published: 2025-04-09
Description: Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-25053
Published: 2025-04-09
Description: OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-25056
Published: 2025-04-09
Description: Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations may be performed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-25213
Published: 2025-04-09
Description: Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-27722
Published: 2025-04-09
Description: Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote unauthenticated attacker to eavesdrop the communication and obtain the authentication information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-27797
Published: 2025-04-09
Description: OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-27934
Published: 2025-04-09
Description: Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2025-29870
Published: 2025-04-09
Description: Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product configuration information including authentication information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://jvn.jp/en/vu/JVNVU93925742/; https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
CVE: CVE-2017-20197
Published: 2025-04-09
Description: A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The name of the patch is b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/propanetank/Roommate-Bill-Tracking/commit/b32bb1b940f82d38fb9310cd66ebe349e20a1d0a; https://vuldb.com/?ctiid.303640; https://vuldb.com/?id.303640
CVE: CVE-2025-2222
Published: 2025-04-09
Description: CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak
information and potential privilege escalation following man in the middle attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-01.pdf
CVE: CVE-2025-2223
Published: 2025-04-09
Description: CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and
Availability of engineering workstation when a malicious project file is loaded by a user from the local system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-01.pdf
CVE: CVE-2025-2440
Published: 2025-04-09
Description: CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized
access of confidential data when a malicious user, having physical access and advanced information on the file
system, sets the radio in factory default mode.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-922
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE: CVE-2025-2441
Published: 2025-04-09
Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of
confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the
product does not correctly initialize all data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1188
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE: CVE-2025-2442
Published: 2025-04-09
Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to
unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious
user, having physical access, sets the radio to the factory default mode.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1188
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE: CVE-2025-29189
Published: 2025-04-09
Description: Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing; https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing
CVE: CVE-2025-30677
Published: 2025-04-09
Description: Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.


This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.

This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.


3.0.x version users should upgrade to at least 3.0.11.

3.3.x version users should upgrade to at least 3.3.6.

4.0.x version users should upgrade to at least 4.0.4.


Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d; https://pulsar.apache.org/security/; http://www.openwall.com/lists/oss-security/2025/04/09/2
CVE: CVE-2025-31672
Published: 2025-04-09
Description: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.
This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.
Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read  https://poi.apache.org/security.html  for recommendations about how to use the POI libraries securely.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://bz.apache.org/bugzilla/show_bug.cgi?id=69620; https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5; http://www.openwall.com/lists/oss-security/2025/04/08/2
CVE: CVE-2023-33844
Published: 2025-04-09
Description: IBM Security Verify Governance 10.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7230443
CVE: CVE-2025-1968
Published: 2025-04-09
Description: Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.
CVSS Score: 7.7 (HIGH)
CWE: CWE-613
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025
CVE: CVE-2025-25023
Published: 2025-04-09
Description: IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7230467
CVE: CVE-2025-27391
Published: 2025-04-09
Description: Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

Users are recommended to upgrade to version 2.40.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://lists.apache.org/thread/25p96cvzl1mkt29lwm2d8knklkoqolps; http://www.openwall.com/lists/oss-security/2025/04/09/3
CVE: CVE-2025-29389
Published: 2025-04-09
Description: PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/jaylan545/0540db17daca2bf42fe5a3ce864300c9; https://github.com/jaylan545/security/issues/1
CVE: CVE-2025-29390
Published: 2025-04-09
Description: jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/jaylan545/dbe989f09c73e311ccbfe[PII_REDACTED]c; https://github.com/jerryhanjj/ERP/issues/7
CVE: CVE-2025-29391
Published: 2025-04-09
Description: horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://gist.github.com/jaylan545/73dee34609ac492b9009625fb985cde4; https://github.com/horvey/Library-Manager/issues/9
CVE: CVE-2025-29394
Published: 2025-04-09
Description: An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://gist.github.com/jaylan545/01e9653c[PII_REDACTED]927fe6f00cd82e; https://github.com/Verytops/verydows/issues/24
CVE: CVE-2025-32016
Published: 2025-04-09
Description: Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform (formerly Azure AD v2.0 endpoint) and AAD B2C. This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely. Service logs generated at the information level or credential descriptions containing local file paths with passwords, Base64 encoded values, or Client secret. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status. To mitigate this vulnerability, update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-532
References: https://github.com/AzureAD/microsoft-identity-web/security/advisories/GHSA-rpq8-q44m-2rpg
CVE: CVE-2025-32371
Published: 2025-04-09
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://github.com/dnnsoftware/Dnn.Platform/commit/5def7cc2e7931bb1041b21540bde99f96874a5a9; https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2rrc-g594-rhqw
CVE: CVE-2025-32372
Published: 2025-04-09
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/dnnsoftware/Dnn.Platform/commit/4721dd9eef846936d3b1a3676499e46968d15feb; https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m
CVE: CVE-2025-32373
Published: 2025-04-09
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm-4rwh-chpc
CVE: CVE-2025-32374
Published: 2025-04-09
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vc6j-mcqj-rgfp
CVE: CVE-2025-32375
Published: 2025-04-09
Description: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26; https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26
CVE: CVE-2025-32378
Published: 2025-04-09
Description: Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799
References: https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m
CVE: CVE-2025-32379
Published: 2025-04-09
Description: Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe[PII_REDACTED]7687312; https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v