CVE-2025-1007

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-283 CWE-285

Affected software

Vendor	Product	Versions
Eclipse Foundation	OpenVSX	>= 0.9.0, <= 0.20.0

References

https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4hExploit, Vendor Advisory

Timeline

Published: Feb 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-100706.3A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation ca CVE-2025-100716.3A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-e CVE-2025-100726.3A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/CVE-2025-100734.3A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing m CVE-2025-100745.4A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. CVE-2025-100755.4A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /ma CVE-2025-100769.8A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php CVE-2025-100779.8A security vulnerability has been detected in SourceCodester Online Polling System 1.0. This impacts an unknown function of the file /regist CVE-2025-100789.8A vulnerability was detected in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/candidates.php.CVE-2025-100799.8A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Ex CVE-2025-10086.4The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all ve CVE-2025-100803.1A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file