First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-10282

MediumCVSS 4.7/10Last modified Oct 8, 2026

Description

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
BLSOPS, LLC	bbot	>= 0.0.0, <= 2.6.1

References

https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper

Timeline

Published: Oct 9, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-102839.6BBOT's gitdumper module could be abused to execute commands through a malicious git repository.CVE-2025-102849.6BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, r CVE-2025-102857.4The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an atta CVE-2025-102873.1A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown funct CVE-2025-102885.3A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The impacted element is an unknown function o CVE-2025-102895.9The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.CVE-2025-10297.5Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executabl CVE-2025-102906.5Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, a CVE-2025-102918.8A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale CVE-2025-102938.8The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versio CVE-2025-102949.8The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This i CVE-2025-102956.4The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting the profile media uplo

CVE-2025-10282: Medium severity, CVSS 4.7 | Vulnix