CVE-2025-52662

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 7, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-526637.3A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This iCVE-2025-526648.8SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by loggCVE-2025-5266510.0A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, tCVE-2025-526662.7Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administratorCVE-2025-526675.4Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possibCVE-2025-526685.4Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential iCVE-2025-526694.3Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to havCVE-2025-52675.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerabCVE-2025-526706.5Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by otCVE-2025-526714.3Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to aCVE-2025-52688.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence oCVE-2025-526872.4Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious