CVE-2025-31482

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
FreshRSS	FreshRSS	< 1.26.2

References

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-vpmc-3fv2-jmgpExploit, Vendor Advisory

Timeline

Published: Jun 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-314834.8Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy an CVE-2025-314849.3conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and CVE-2025-314857.5API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property m CVE-2025-314865.3Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.CVE-2025-314877.7The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is inst CVE-2025-314885.0Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as Web CVE-2025-314898.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorizati CVE-2025-31494.8A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an un CVE-2025-314907.5AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workfl CVE-2025-314918.6AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workfl CVE-2025-314928.2mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Co CVE-2025-314939.1Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites