CVE-2025-15414

MediumCVSS 4.7/10Last modified Oct 7, 2026

Description

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
go-sonicsonic1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4

References

Timeline

Published
Jan 1, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-154155.4A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.CVE-2025-154165.4A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add GCVE-2025-154175.5A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/CVE-2025-154185.5A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the CVE-2025-154195.5A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of theCVE-2025-15429.3Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivilegCVE-2025-154209.8A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. ThCVE-2025-154219.8A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the coCVE-2025-154227.5A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the compoCVE-2025-154238.8A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connectCVE-2025-154249.8A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the cCVE-2025-154259.8A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the co