CVE-2025-31132

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
The-Commit-Companyraven< 2.1.10

References

Timeline

Published
Apr 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-311337.8runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1CVE-2025-311347.5FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checCVE-2025-311355.3Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be acceCVE-2025-311365.4FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This ocCVE-2025-311377.5React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React RouterCVE-2025-311386.6tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where userCVE-2025-311396.5In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logCVE-2025-31149.4Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate securiCVE-2025-311406.1In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageCVE-2025-311417.5In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageCVE-2025-311446.9Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, aCVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: