CVE-2025-24337

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

VendorProductVersions
Musing StudioWriteFreely<= 0.15.1

References

Timeline

Published
Jan 20, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-243387.1A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attCVE-2025-243395.0A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the CVE-2025-243406.5A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintCVE-2025-243416.5A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoCVE-2025-243425.3A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernaCVE-2025-243435.4A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atCVE-2025-243446.3A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbCVE-2025-243456.3A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mCVE-2025-243467.5A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maCVE-2025-243476.5A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243485.4A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243497.1A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) a
CVE-2025-24337: High severity, CVSS 8.4 | Vulnix