CWE-425

{
  "affected": [],
  "aliases": [
    "CVE-2025-59797"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T13:16:01Z",
    "severity": "MODERATE"
  },
  "details": "Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane page.",
  "id": "GHSA-rhvx-hr6c-q6qj",
  "modified": "2025-09-22T21:30:21Z",
  "published": "2025-09-22T21:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59797"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Henkel-CyberVM/CVEs/blob/main/CVE-2025-59797/README.md"
    },
    {
      "type": "WEB",
      "url": "https://www.profession-fit.de"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-28160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-02T17:15:12Z",
    "severity": "MODERATE"
  },
  "details": "When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox \u003c 111.",
  "id": "GHSA-rm3j-9j4x-mr94",
  "modified": "2024-04-04T04:30:25Z",
  "published": "2023-06-02T18:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28160"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1802385"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-10287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-12T05:15:32Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /auth/orderQuery. Such manipulation of the argument orderNo leads to direct request. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-rm4g-r867-8r8c",
  "modified": "2025-09-12T06:30:25Z",
  "published": "2025-09-12T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10287"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.323649"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.323649"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.643387"
    },
    {
      "type": "WEB",
      "url": "https://www.cnblogs.com/aibot/p/19063496"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-16388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-26T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account.",
  "id": "GHSA-rpjx-w3gx-pgp2",
  "modified": "2024-03-21T03:33:47Z",
  "published": "2022-05-24T17:02:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16388"
    },
    {
      "type": "WEB",
      "url": "https://blog.cybercastrum.com/2019/11/25/cve-2019-16388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-24T20:15:05Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /E-Insurance/. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272365 was assigned to this vulnerability.",
  "id": "GHSA-rqq7-hjc5-3h3v",
  "modified": "2024-07-24T21:31:31Z",
  "published": "2024-07-24T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7080"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Xu-Mingming/cve/blob/main/bianli.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.272365"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.272365"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.379487"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-16060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-15T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Mitsubishi Electric SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.",
  "id": "GHSA-rw74-237r-47cj",
  "modified": "2024-09-10T18:30:41Z",
  "published": "2022-05-24T19:17:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16060"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/164538/Mitsubishi-Electric-INEA-SmartRTU-Source-Code-Disclosure.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openflagr/flagr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20251009103504-fe83dc87aa40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-0650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-425"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-07T19:31:31Z",
    "nvd_published_at": "2026-01-07T12:17:07Z",
    "severity": "CRITICAL"
  },
  "details": "OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.",
  "id": "GHSA-rwp9-5g7q-73q3",
  "modified": "2026-01-07T19:31:31Z",
  "published": "2026-01-07T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0650"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openflagr/flagr/commit/fe83dc87aa404a57554aa5839ac450f55c203570"
    },
    {
      "type": "WEB",
      "url": "https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openflagr/flagr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openflagr/flagr/releases/tag/1.1.19"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "notebook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-16T23:10:10Z",
    "nvd_published_at": "2022-06-14T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAuthenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were \u0027hidden\u0027 but not \u0027inaccessible\u0027). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed.\n\nBecause fully authenticated requests are required, this is of relatively low impact. But if a server\u0027s root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended _means_ by which the files could be accessed.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nnotebook 6.4.12\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- Do not run the notebook server in a directory with hidden files, use subdirectories\n- Use a custom ContentsManager with additional checks for `self.is_hidden(path)` prior to completing actions\n\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)\n",
  "id": "GHSA-v7vq-3x77-87vg",
  "modified": "2022-06-16T23:10:10Z",
  "published": "2022-06-16T23:10:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter/notebook/security/advisories/GHSA-v7vq-3x77-87vg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29238"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter/notebook"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2022-212.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Token bruteforcing."
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-05T04:15:35Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.",
  "id": "GHSA-v97w-vr8h-fvmm",
  "modified": "2025-10-05T06:30:14Z",
  "published": "2025-10-05T06:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11280"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1#steps-to-reproduce"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.327014"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.327014"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.659694"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-9884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-425"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-25T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "eClass platform \u003c ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.",
  "id": "GHSA-v994-ggf7-gpj5",
  "modified": "2024-04-04T01:22:58Z",
  "published": "2022-05-24T16:51:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9884"
    },
    {
      "type": "WEB",
      "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201904004"
    },
    {
      "type": "WEB",
      "url": "https://zeroday.hitcon.org/vulnerability/ZD-2019-00332"
    },
    {
      "type": "WEB",
      "url": "http://surl.twcert.org.tw/b7jfz"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}