CVE-2025-24948

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-598

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-249496.5In JotUrl 2.0, is possible to bypass security requirements during the password change process.CVE-2025-24955.4Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the CVE-2025-249569.8A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsiCVE-2025-249579.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socCVE-2025-249588.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` CVE-2025-249591.0zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variablCVE-2025-249608.7Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(CVE-2025-249616.0org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionaCVE-2025-249628.8reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd paraCVE-2025-249637.5Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on thCVE-2025-249648.8Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious wCVE-2025-249658.5crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handl