CVE-2025-0709

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	Dcat-Admin	2.2.1-beta

References

https://github.com/taynes-llllzt/taynes/issues/7Exploit, Third Party Advisory
https://github.com/taynes-llllzt/taynes/issues/7#issue-2792259251Exploit, Third Party Advisory
https://vuldb.com/?ctiid.293237Permissions Required, VDB Entry
https://vuldb.com/?id.293237Third Party Advisory, VDB Entry
https://vuldb.com/?submit.483364Third Party Advisory, VDB Entry

Timeline

Published: Jan 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-07105.4A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the CVE-2025-07127.0An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulne CVE-2025-07146.5The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) CVE-2025-07164.8Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypa CVE-2025-07173.5To exploit the vulnerability, it is necessary:CVE-2025-07184.8The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2025-07196.1IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated att CVE-2025-07205.5A vulnerability was found in Microword eScan Antivirus 7.0.32 on Linux. It has been rated as problematic. Affected by this issue is the func CVE-2025-07216.1A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file CVE-2025-07227.2A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/CVE-2025-07236.5The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the ri CVE-2025-07248.8The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, an