deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48141
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through <= 2.0.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/multi-crypto-currency-payment/vulnerability/wordpress-multi-cryptocurrency-payments-2-0-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48143
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through <= 1.0.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/formularios-de-contacto-salesup/vulnerability/wordpress-formulario-de-contacto-salesup-plugin-1-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48147
Published: 2025-06-09
Description: Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cryptocloud-crypto-payment-gateway/vulnerability/wordpress-cryptocloud-crypto-payment-gateway-2-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48261
Published: 2025-06-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-4-2-22-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-48267
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-2-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-48279
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wc-myparcel-belgium/vulnerability/wordpress-wc-myparcel-belgium-plugin-4-5-5-beta-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48281
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/mystyle-custom-product-designer/vulnerability/wordpress-mystyle-custom-product-designer-3-21-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49265
Published: 2025-06-09
Description: Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-2-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49275
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogbyte blogbyte allows PHP Local File Inclusion.This issue affects Blogbyte: from n/a through <= 1.1.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/blogbyte/vulnerability/wordpress-blogbyte-1-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49276
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogmine blogmine allows PHP Local File Inclusion.This issue affects Blogmine: from n/a through <= 1.1.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/blogmine/vulnerability/wordpress-blogmine-1-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49277
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogprise blogprise allows PHP Local File Inclusion.This issue affects Blogprise: from n/a through <= 1.0.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/blogprise/vulnerability/wordpress-blogprise-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49278
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through <= 1.0.11.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/blogty/vulnerability/wordpress-blogty-1-0-11-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49279
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogvy blogvy allows PHP Local File Inclusion.This issue affects Blogvy: from n/a through <= 1.0.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/blogvy/vulnerability/wordpress-blogvy-1-0-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49280
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magty magty allows PHP Local File Inclusion.This issue affects Magty: from n/a through <= 1.0.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/magty/vulnerability/wordpress-magty-1-0-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49281
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magways magways allows PHP Local File Inclusion.This issue affects Magways: from n/a through <= 1.2.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/magways/vulnerability/wordpress-magways-1-2-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49282
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magze magze allows PHP Local File Inclusion.This issue affects Magze: from n/a through <= 1.0.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/magze/vulnerability/wordpress-magze-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49295
Published: 2025-06-09
Description: Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Theme/mediclinic/vulnerability/wordpress-mediclinic-2-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49296
Published: 2025-06-09
Description: Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Theme/grandprix/vulnerability/wordpress-grandprix-1-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49297
Published: 2025-06-09
Description: Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Theme/grillandchow/vulnerability/wordpress-grill-and-chow-1-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-5886
Published: 2025-06-09
Description: A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The manipulation of the argument active_post leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/users/God-mellon/projects/3/views/1?pane=issue&itemId=109223682&issue=God-mellon%7Ctest2%7C2; https://vuldb.com/?ctiid.311657; https://vuldb.com/?id.311657
CVE: CVE-2024-46452
Published: 2025-06-09
Description: A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2024-46452; https://github.com/codervivek5/VigyBag; https://www.vigybag.com
CVE: CVE-2025-29627
Published: 2025-06-09
Description: An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/SahilDabhilkar/CVE-Reference/blob/main/CVE-2025-29627.md; https://www.keepersecurity.com/; https://www.keepersecurity.com/en_GB/keeperchat.html
CVE: CVE-2025-45001
Published: 2025-06-09
Description: react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5; https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45001; https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5
CVE: CVE-2025-45002
Published: 2025-06-09
Description: Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45002; https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45002
CVE: CVE-2025-46041
Published: 2025-06-09
Description: A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://anchor.com; https://github.com/binneko/CVE-2025-46041; https://github.com/binneko/CVE-2025-46041
CVE: CVE-2025-49136
Published: 2025-06-09
Description: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-1336
References: https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e; https://github.com/knadh/listmonk/releases/tag/v5.0.2; https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h
CVE: CVE-2025-5887
Published: 2025-06-09
Description: A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been classified as problematic. Affected is an unknown function of the file UserMgrController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Aiyakami/CVE-1/issues/4; https://vuldb.com/?ctiid.311658; https://vuldb.com/?id.311658
CVE: CVE-2024-47081
Published: 2025-06-09
Description: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef; https://github.com/psf/requests/pull/6965; https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
CVE: CVE-2025-49651
Published: 2025-06-09
Description: Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/
CVE: CVE-2025-49652
Published: 2025-06-09
Description: Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/
CVE: CVE-2025-49653
Published: 2025-06-09
Description: Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200
References: https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/
CVE: CVE-2025-5888
Published: 2025-06-09
Description: A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/Aiyakami/CVE-1/issues/5; https://github.com/luokuang1/CVE/issues/1; https://vuldb.com/?ctiid.311659
CVE: CVE-2025-5889
Published: 2025-06-09
Description: A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-1333
References: https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466; https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5; https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1
CVE: CVE-2025-5890
Published: 2025-06-09
Description: A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/actions/toolkit/pull/2057; https://vuldb.com/?ctiid.311661; https://vuldb.com/?id.311661
CVE: CVE-2025-5891
Published: 2025-06-09
Description: A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://gist.github.com/mmmsssttt404/407e2ffe3e0eaa393ad923a86316a385; https://github.com/Unitech/pm2/pull/5971; https://vuldb.com/?ctiid.311662
CVE: CVE-2025-5892
Published: 2025-06-09
Description: A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://gist.github.com/mmmsssttt404/0fcda3b3e85edafc4eaa6816aa252deb; https://github.com/RocketChat/Rocket.Chat/pull/35711; https://vuldb.com/?ctiid.311663
CVE: CVE-2025-5895
Published: 2025-06-09
Description: A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://github.com/metabase/metabase/commit/4454ebbdc7719016bf80ca0f34859ce5cee9f6b0; https://github.com/metabase/metabase/pull/57011; https://github.com/metabase/metabase/pull/57011#pullrequestreview[PII_REDACTED]
CVE: CVE-2025-5914
Published: 2025-06-09
Description: A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:14130; https://access.redhat.com/errata/RHSA-2025:14135; https://access.redhat.com/errata/RHSA-2025:14137
CVE: CVE-2025-5915
Published: 2025-06-09
Description: A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-122
References: https://access.redhat.com/security/cve/CVE-2025-5915; https://bugzilla.redhat.com/show_bug.cgi?id=2370865; https://github.com/libarchive/libarchive/pull/2599
CVE: CVE-2025-5916
Published: 2025-06-09
Description: A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.
CVSS Score: 3.9 (LOW)
CWE: CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-5916; https://bugzilla.redhat.com/show_bug.cgi?id=2370872; https://github.com/libarchive/libarchive/pull/2568
CVE: CVE-2025-5917
Published: 2025-06-09
Description: A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.
CVSS Score: 2.8 (LOW)
CWE: CWE-787
References: https://access.redhat.com/security/cve/CVE-2025-5917; https://bugzilla.redhat.com/show_bug.cgi?id=2370874; https://github.com/libarchive/libarchive/pull/2588
CVE: CVE-2025-5918
Published: 2025-06-09
Description: A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
CVSS Score: 3.9 (LOW)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2025-5918; https://bugzilla.redhat.com/show_bug.cgi?id=2370877; https://github.com/libarchive/libarchive/pull/2584
CVE: CVE-2025-49004
Published: 2025-06-09
Description: Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website loaded in the browser can hijack the locally running Caido instance and achieve remote command execution during the initial setup. Even if the Caido instance is already configured, an attacker can initiate the authentication flow by performing DNS rebinding. In this case, the victim needs to authorize the request on dashboard.caido.io. Users should upgrade to version 0.48.0 to receive a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://github.com/caido/caido/security/advisories/GHSA-jmxf-xw2r-vjrg