CVE-2025-0704

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument w/h leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-404

Affected software

Vendor	Product	Versions
JoeyBling	bootplus	247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d

References

https://github.com/JoeyBling/bootplus/issues/26Not Applicable
https://github.com/JoeyBling/bootplus/issues/26#issue-2786934642Not Applicable
https://vuldb.com/?ctiid.293232Permissions Required, VDB Entry
https://vuldb.com/?id.293232Third Party Advisory, VDB Entry
https://vuldb.com/?submit.480843Third Party Advisory, VDB Entry

Timeline

Published: Jan 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-07056.1A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected CVE-2025-07065.4A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by th CVE-2025-07077.8A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the libr CVE-2025-07085.4A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /a CVE-2025-07094.8A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file CVE-2025-07105.4A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the CVE-2025-07127.0An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulne CVE-2025-07146.5The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) CVE-2025-07164.8Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypa CVE-2025-07173.5To exploit the vulnerability, it is necessary:CVE-2025-07184.8The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2025-07196.1IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated att