CVE-2025-51867

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits via sensitive information gained by the /browse/stories endpoint.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-518687.5Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the con CVE-2025-518697.5Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted sp CVE-2025-51876.7A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding no CVE-2025-51908.8The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect au CVE-2025-51917.3An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path CVE-2025-51927.5A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System th CVE-2025-51944.8The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page CVE-2025-51954.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-519516.1andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-519546.1playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-519589.8aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugin CVE-2025-51966.6A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown funct