rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-65037 Azure Container Apps Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Microsoft
product: Azure Container Apps
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-12-18T22:02:06.737Z
CVE-2025-65041 Microsoft Partner Center Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Microsoft
product: Microsoft Partner Center
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:T/RC:C
Published: 2025-12-18T22:02:06.021Z
CVE-2025-65046 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Problem types: cwe_id: CWE-451
description: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: Microsoft
product: Microsoft Edge for Android
CVSS v3.1: version: 3.1
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C
Published: 2025-12-18T22:01:43.462Z
CVE-2025-65073 
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: OpenStack
product: Keystone
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Published: 2025-11-17T00:00:00.000Z
CVE-2025-65074 OS Command Injection via Path Traversal in WaveStore Server
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script.

This issue was fixed in version 6.44.44
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: WaveStore
product: WaveStore Server
default_status: unaffected
Credits: lang: en
value: Julia Zduńczyk
Published: 2025-12-16T12:25:15.751Z
CVE-2025-65075 Arbitrary File Read and Delete via Path Traversal in WaveStore Server
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete files, with the permissions of dvr user, on the server using path traversal in the alog script.

This issue was fixed in version 6.44.44
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: WaveStore
product: WaveStore Server
default_status: unaffected
Credits: lang: en
value: Julia Zduńczyk
Published: 2025-12-16T12:25:17.584Z
CVE-2025-65076 Arbitrary File Read and Delete via Path Traversal in WaveStore Server
WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root privileges.

This issue was fixed in version 6.44.44
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: WaveStore
product: WaveStore Server
default_status: unaffected
Credits: lang: en
value: Julia Zduńczyk
Published: 2025-12-16T12:25:24.801Z
CVE-2025-65077 Relative path traversal vulnerability in Embedded Solutions Framework
A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Lexmark
product: MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ
default_status: unaffected
vendor: Lexmark
product: CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG
default_status: unaffected
Published: 2026-02-03T20:44:32.330Z
CVE-2025-65078 Untrusted search path vulnerability in Embedded Solutions Framework
An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Lexmark
product: MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ
default_status: unaffected
vendor: Lexmark
product: CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG
default_status: unaffected
Published: 2026-02-03T20:51:20.556Z
CVE-2025-65079 Heap-based buffer overflow vulnerability in Postscript interpreter
A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Lexmark
product: MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ
default_status: unaffected
vendor: Lexmark
product: CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG
default_status: unaffected
Published: 2026-02-03T20:23:24.405Z
CVE-2025-65080 Type confusion vulnerability in Postscript interpreter
A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Lexmark
product: MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ
default_status: unaffected
vendor: Lexmark
product: CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG
default_status: unaffected
Published: 2026-02-03T20:35:54.592Z
CVE-2025-65081 Out-of-bounds read vulnerability in Postscript interpreter
An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Lexmark
product: MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ
default_status: unaffected
vendor: Lexmark
product: CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG
default_status: unaffected
Published: 2026-02-03T20:39:14.501Z
CVE-2025-65082 Apache HTTP Server: CGI environment variable override
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.
Problem types: cwe_id: CWE-150
description: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Mattias Åsander (Umeå University)
Published: 2025-12-05T10:46:27.138Z
CVE-2025-65083 
GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user selects an arbitrary proxy server without consideration of whether outbound HTTPS connections from the proxy server to Internet servers succeed even for untrusted or invalid server certificates. In this scenario (which is outside of the product's design objectives), integrity protection could be bypassed. In typical cases of a proxy server for outbound HTTPS traffic from an enterprise, those connections would not succeed. (Admittedly, the usual expectation is that a client application is configured to trust an enterprise CA and does not set SSL_VERIFY_NONE.) Also, it is of course unsafe to place ~/.gosign in the home directory of an untrusted user and then have other users execute downloaded files.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Tinexta Infocert
product: GoSign Desktop
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-11-17T00:00:00.000Z
CVE-2025-65084 Out-of-bounds Write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2025-11-25T17:48:55.213Z
CVE-2025-65085 Heap-based Buffer Overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2025-11-25T17:49:58.145Z
CVE-2025-65086 Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to execute arbitrary code when a specially crafted VC6 file is being parsed.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2026-05-12T20:22:42.842Z
CVE-2025-65087 Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2026-05-12T20:25:08.947Z
CVE-2025-65088 Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2026-05-12T20:27:39.156Z
CVE-2025-65089 XWiki view file macro: User can view content of office file without view rights on the attachment
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: xwikisas
product: xwiki-pro-macros
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-11-19T17:41:31.805Z
CVE-2025-65090 XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: xwiki-contrib
product: macro-fullcalendar
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2026-01-10T03:05:06.531Z
CVE-2025-65091 XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: xwiki-contrib
product: macro-fullcalendar
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2026-01-10T03:06:16.775Z
CVE-2025-65092 ESP32-P4 JPEG Decoder Header Parsing Vulnerability
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: espressif
product: esp-idf
Published: 2025-11-21T21:33:03.656Z
CVE-2025-65093 LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: librenms
product: librenms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-11-18T23:02:04.572Z
CVE-2025-65094 WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)
WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but server-side validation is missing, allowing attackers to overwrite their group membership and obtain full administrative access. This results in a complete compromise of the CMS. This issue has been patched in version 1.6.4.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: WBCE
product: WBCE_CMS
Published: 2025-11-19T19:06:21.569Z
CVE-2025-65095 Lookyloo is vulnerable due to improper user input sanitization
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there is potential cross-site scripting on index and tree page. This issue has been patched in version 1.35.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Lookyloo
product: lookyloo
Published: 2025-11-19T17:38:55.916Z
CVE-2025-65096 RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: rommapp
product: romm
Published: 2025-12-03T19:39:53.722Z
CVE-2025-65097 Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: rommapp
product: romm
Published: 2025-12-03T19:41:33.262Z
CVE-2025-65098 Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: baptisteArno
product: typebot.io
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2026-01-22T14:59:20.488Z