CVE-2025-29033

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-290365.9An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.CVE-2025-290397.2An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8CVE-2025-290409.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737cCVE-2025-290419.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710cCVE-2025-290429.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232cCVE-2025-290439.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234CVE-2025-290449.8Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key vCVE-2025-290459.8Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key valueCVE-2025-290469.8Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSCVE-2025-290479.8Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddCVE-2025-290496.3Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitraryCVE-2025-29059.1Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External
CVE-2025-29033: High severity, CVSS 7.3 | Vulnix