{"vulnerability": "cve-2025-5289", "sightings": [{"uuid": "3859caa9-9532-432c-beee-0e7d4eeb2172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52891", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114784351442677607", "content": "", "creation_timestamp": "2025-07-02T15:30:07.095151Z"}, {"uuid": "e3022fa6-3abe-4c5e-b4af-74c04d508b4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52898", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsu4ya5zny2i", "content": "", "creation_timestamp": "2025-06-30T21:30:25.910736Z"}, {"uuid": "ab16dffd-6e7e-4e0f-a5b2-af94ac4dac6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-52891", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875", "content": "", "creation_timestamp": "2026-01-21T21:18:16.771453Z"}, {"uuid": "b636c926-1839-4832-9f2a-b0e0f7b9d384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5289", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ls4oyhx4fm2i", "content": "", "creation_timestamp": "2025-06-21T13:48:47.903215Z"}, {"uuid": "dbd7dc0a-c1de-424f-8430-9f09cb603af5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52890", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lshht5vxcq2q", "content": "", "creation_timestamp": "2025-06-25T20:39:50.233353Z"}, {"uuid": "f6febd8c-3999-44b9-a5df-8260953cb731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52891", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3lt27egd34h2a", "content": "", "creation_timestamp": "2025-07-03T07:29:00.876064Z"}, {"uuid": "9919bf8f-b595-4d84-82ee-88158973ec49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52890", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lvyc46x65k2r", "content": "", "creation_timestamp": "2025-08-09T17:28:25.004615Z"}, {"uuid": "637ae4cb-2dbe-4d69-bf31-3dc2e9a86d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52895", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19977", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52895\n\ud83d\udd25 CVSS Score: 8.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.\n\ud83d\udccf Published: 2025-06-30T17:05:36.027Z\n\ud83d\udccf Modified: 2025-06-30T20:40:43.365Z\n\ud83d\udd17 References:\n1. https://github.com/frappe/frappe/security/advisories/GHSA-mhj8-jfhf-mcw9\n2. https://github.com/frappe/frappe/pull/31526\n3. https://github.com/frappe/frappe/commit/c795e351be033070174437324d74f44759a744a6\n4. https://github.com/frappe/frappe/commit/f0933590103c80c6393647dd0403d399e64c951c", "creation_timestamp": "2025-06-30T21:09:25.000000Z"}, {"uuid": "66aafc4d-5a8c-4b37-a0a0-8f4e11850f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52896", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19978", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52896\n\ud83d\udd25 CVSS Score: 8.6 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.\n\ud83d\udccf Published: 2025-06-30T17:12:50.590Z\n\ud83d\udccf Modified: 2025-06-30T20:39:38.755Z\n\ud83d\udd17 References:\n1. https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p\n2. https://github.com/frappe/frappe/pull/31483\n3. https://github.com/frappe/frappe/commit/152fd09de5bca16b8d299d715a1f5df6fca3866f\n4. https://github.com/frappe/frappe/commit/f11c53d4df745b58bd1c1c08e1634a2f5a55322a", "creation_timestamp": "2025-06-30T21:09:26.000000Z"}, {"uuid": "fed58dc3-bdc4-47b1-b964-cfd455f6f424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52894", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19493", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52894\n\ud83d\udd25 CVSS Score: 6.9 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.\n\ud83d\udccf Published: 2025-06-25T16:59:02.058Z\n\ud83d\udccf Modified: 2025-06-25T17:00:31.313Z\n\ud83d\udd17 References:\n1. https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h\n2. https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b\n3. https://openbao.org/docs/deprecation\n4. https://openbao.org/docs/deprecation/unauthed-rekey", "creation_timestamp": "2025-06-25T18:06:24.000000Z"}, {"uuid": "2932bc12-9a4d-4ea2-87f3-6948de7a7c45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5289", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/19113", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-5289\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The 3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018style\u2019 and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.\n\ud83d\udccf Published: 2025-06-21T11:09:40.461Z\n\ud83d\udccf Modified: 2025-06-21T11:09:40.461Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/72b76475-5215-47fd-badf-e2c542b25d4b?source=cve\n2. https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L134\n3. https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L130\n4. https://wordpress.org/plugins/interactive-3d-flipbook-powered-physics-engine/#developers\n5. https://plugins.trac.wordpress.org/changeset/3315198/", "creation_timestamp": "2025-06-21T11:43:13.000000Z"}, {"uuid": "55bc0682-3bb8-4938-adb1-f65894e47692", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52893", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/19495", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52893\n\ud83d\udd25 CVSS Score: 4.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)\n\ud83d\udd39 Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.\n\ud83d\udccf Published: 2025-06-25T16:54:50.262Z\n\ud83d\udccf Modified: 2025-06-25T16:54:50.262Z\n\ud83d\udd17 References:\n1. https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq\n2. https://github.com/go-viper/mapstructure/pull/105\n3. https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a\n4. https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30\n5. https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717\n6. https://github.com/go-viper/mapstructure/releases/tag/v2.3.0", "creation_timestamp": "2025-06-25T18:06:26.000000Z"}, {"uuid": "92eebe21-8162-4289-82b4-bb9aa7acaaf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-52890", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19497", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-52890\n\ud83d\udd25 CVSS Score: 8.1 (cvssV3_1, Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H)\n\ud83d\udd39 Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.\n\ud83d\udccf Published: 2025-06-25T16:51:24.279Z\n\ud83d\udccf Modified: 2025-06-25T16:51:24.279Z\n\ud83d\udd17 References:\n1. https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp\n2. https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8", "creation_timestamp": "2025-06-25T18:06:28.000000Z"}, {"uuid": "076ce013-7304-4e06-ac4c-2a22b7731ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-52890", "type": "published-proof-of-concept", "source": "https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp", "content": "", "creation_timestamp": "2025-06-25T14:13:03.000000Z"}]}