CVE-2025-46729

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

julmud/phpDVDProfiler is an adoption of the defunct phpDVDProfiler project, which allows users to display on the web their DVD collections maintained with Invelos's DVDProfiler software. Starting in v_20230807 and prior to v_20250511, cross-site scripting in the search function. v_20250511 contains a patch for the issue.

Metrics

CVSS 4.0 2.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-46736.8Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-467306.5MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that a CVE-2025-467317.2Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contain CVE-2025-467325.4OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnera CVE-2025-467337.9OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2025-467346.4league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark CVE-2025-467351.1Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Te CVE-2025-467365.3Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing o CVE-2025-467377.4SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in th CVE-2025-467386.6An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.CVE-2025-467398.1An unauthenticated user could discover account credentials via a brute-force attack without rate limiting CVE-2025-46748.6The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configu