CVE-2025-65827

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Dec 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-658286.5An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these deviCVE-2025-658296.8The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures CVE-2025-65838.8A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown parCVE-2025-658309.1Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstCVE-2025-658317.5The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through eCVE-2025-658324.6The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has CVE-2025-658349.8Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipulCVE-2025-658356.2The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiveCVE-2025-658369.1PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.CVE-2025-658375.4PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.CVE-2025-658387.5PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.CVE-2025-658408.8PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.