CVE-2025-31122

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.

Metrics

CVSS 4.0 9.0/10CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-287CWE-290

Affected software

VendorProductVersions
Scratch-Coding-HutScratch-Coding-Hut<= 1.0-beta3

References

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-311238.7Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. SpecificCVE-2025-311245.3Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" whiCVE-2025-311257.5Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only appCVE-2025-311265.3Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the CVE-2025-311275.3Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity inCVE-2025-311286.9gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. ThiCVE-2025-311298.8Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. ThiCVE-2025-31139.0A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leveCVE-2025-311306.8gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detectioCVE-2025-311317.5YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary CVE-2025-311328.1Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerabiliCVE-2025-311337.8runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1
CVE-2025-31122: Critical severity, CVSS 9.0 | Vulnix