CVE-2025-54291

MediumCVSS 5.3/10Last modified Oct 12, 2026

Description

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2025
Last modified: Oct 12, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-542924.6Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or mo CVE-2025-542936.5Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary CVE-2025-542949.3A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL CVE-2025-542955.1A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.CVE-2025-542967.0A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.CVE-2025-542977.0A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.CVE-2025-542989.4A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.CVE-2025-542999.4A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.CVE-2025-54309.8A vulnerability, which was classified as critical, has been found in AssamLook CMS 1.0. This issue affects some unknown processing of the fi CVE-2025-543008.5A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uplo CVE-2025-543018.5A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped.CVE-2025-543039.8The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API.