{"vulnerability": "cve-2025-4552", "sightings": [{"uuid": "e2e632c9-4d8c-43f9-b826-a5c8343c4c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45529", "type": "seen", "source": "https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lq6gbhbie242", "content": "", "creation_timestamp": "2025-05-27T19:27:46.455070Z"}, {"uuid": "70f4b770-6d6f-477e-aa32-58f69c383047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45529", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lq6nvrinzh2o", "content": "", "creation_timestamp": "2025-05-27T21:44:19.424431Z"}, {"uuid": "a5ba64d3-b9d7-41ac-964f-6d599bbff71f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4552", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lowqemhdsb2h", "content": "", "creation_timestamp": "2025-05-12T00:41:57.472953Z"}, {"uuid": "4bb5e798-85df-4136-aceb-db7f287fb031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45526", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19624", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-45526\n\ud83d\udd25 CVSS Score: 2.9 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\ud83d\udd39 Description: A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content (e.g., 100 million characters) is processed, the reset function in microlight.js consumes excessive memory and CPU resources, causing browser crashes or unresponsiveness. An attacker can exploit this vulnerability by tricking a user into visiting a malicious web page containing a microlight element with large content, resulting in a denial of service. NOTE: this is disputed by multiple parties because a large amount of memory and CPU resources is expected to be needed for content of that size.\n\ud83d\udccf Published: 2025-06-17T00:00:00.000Z\n\ud83d\udccf Modified: 2025-06-26T16:10:51.373Z\n\ud83d\udd17 References:\n1. https://gist.github.com/Rootingg/483b09b760d031b62b172f2153f3ed2a\n2. https://github.com/github/advisory-database/pull/5730", "creation_timestamp": "2025-06-26T16:51:42.000000Z"}, {"uuid": "452471ac-9da3-4e7a-a780-2ee3d169bad8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45525", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/18739", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-45525\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A null pointer dereference vulnerability was discovered in microlight.js (version 0.0.7), a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate the result of a regular expression match before accessing its properties, leading to an uncaught TypeError and potential application crash.\n\ud83d\udccf Published: 2025-06-17T00:00:00.000Z\n\ud83d\udccf Modified: 2025-06-18T13:25:20.926Z\n\ud83d\udd17 References:\n1. https://gist.github.com/Rootingg/843368931f70886bed3cf982f10a4424", "creation_timestamp": "2025-06-18T13:40:30.000000Z"}, {"uuid": "2a2a106e-4979-42c1-9ea5-521d062116b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-4552", "type": "seen", "source": "https://t.me/cvedetector/25061", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-4552 - ContiNew Admin Remote Unverified Password Change Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-4552 \nPublished : May 12, 2025, 12:15 a.m. | 1\u00a0hour, 37\u00a0minutes ago \nDescription : A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. \nSeverity: 5.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-12T04:24:24.000000Z"}, {"uuid": "83b5ba28-c217-4a6e-8aac-07e2cdb0bcf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45528", "type": "seen", "source": "https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61", "content": "# CVE-2025-45528: Arbitrary Code Execution in Nitro PDF Pro for macOS 14.7\n\n- **CVE ID:** CVE-2025-45528\n- **Status:** RESERVED (assigned by MITRE 2025-06-17, Service Request 1843838)\n- **Affected product:** Nitro PDF Pro for macOS, version 14.7\n- **Vendor:** Nitro Software, Inc. \u2014 https://www.gonitro.com/\n- **Vulnerability class:** Arbitrary code execution via crafted file (CWE-94)\n- **Attack vector:** Local \u2014 requires the victim to open a crafted PDF\n- **Reporter:** Mo'men Basel\n\n## Summary\n\nNitro PDF Pro for macOS v14.7 allows a local attacker to execute arbitrary code\nvia a crafted PDF.\n\nThis is the description MITRE assigned CVE-2025-45528 to, verbatim, on\n17 June 2025:\n\n> An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local\n> attacker to execute arbitrary code via a crafted PDF\n\n## Impact\n\nCode execution in the context of the user who opens the document. PDFs are\nroutinely received by email and from untrusted sources, and Nitro PDF Pro is\nfrequently configured as the default handler for the file type on macOS, so the\nrequired user interaction is a low barrier.\n\n## Affected versions\n\nConfirmed on Nitro PDF Pro for macOS 14.7. Later versions have not been assessed\nby the reporter.\n\n## Vendor status\n\nNo advisory for this issue was published by Nitro Software at the time of\nwriting, and the CVE record has remained unpublished since assignment.\n\nNitro Software's security team was contacted at `security@gonitro.com` on\n2026-08-27 with the details and a request for a vendor advisory so this record\ncan be published. This document exists to provide the public reference MITRE\nrequires before a reserved CVE can move to published.\n\n## Timeline\n\n| Date | Event |\n|---|---|\n| 2025-03-28 | Reported to MITRE (Service Request 1843838) |\n| 2025-06-17 | CVE-2025-45528 assigned; record held reserved |\n| 2026-08-27 | Confirmed absent from the CVE List and NVD |\n| 2026-08-27 | Vendor contacted at security@gonitro.com |\n| 2026-08-27 | This advisory published as the public reference |\n\n## Verification of unpublished status\n\nQueried on 2026-08-27:\n\n```\n$ curl -s https://cveawg.mitre.org/api/cve/CVE-2025-45528\n{\"error\":\"CVE_RECORD_DNE\",\"message\":\"The cve record for the cve id does not exist.\"}\n```\n\nThe ID is also absent from the NVD API.\n\n## Credit\n\nMo'men Basel\n", "creation_timestamp": "2026-08-27T12:35:24.351421Z"}]}