CVE-2025-4515

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-346 CWE-942 CWE-697

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-451509.8Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying CVE-2025-451565.3Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.CVE-2025-451576.5Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.CVE-2025-45165.9There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" CVE-2025-451605.4A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, t CVE-2025-45179.4Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnera CVE-2025-45198.8The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missin CVE-2025-45204.3The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple CVE-2025-45218.8The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missin CVE-2025-45226.5The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via CVE-2025-45236.5The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a CVE-2025-452365.4A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web s