CVE-2025-29036

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-290397.2An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8CVE-2025-290409.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737cCVE-2025-290419.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710cCVE-2025-290429.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232cCVE-2025-290439.8An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234CVE-2025-290449.8Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key vCVE-2025-290459.8Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key valueCVE-2025-290469.8Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSCVE-2025-290479.8Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddCVE-2025-290496.3Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitraryCVE-2025-29059.1Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML ExternalCVE-2025-290589.8An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component.
CVE-2025-29036: Medium severity, CVSS 5.9 | Vulnix