CVE-2025-65827

CriticalCVSS 9.1/10Last modified Nov 4, 2026

Description

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-clear-text-traffic-enabled-mdThird Party Advisory
https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Mobile-Application/Clear-Text-Traffic-Enabled.mdThird Party Advisory

Timeline

Published: Dec 10, 2025
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-658286.5An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devi CVE-2025-658296.8The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures CVE-2025-65838.8A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown par CVE-2025-658309.1Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upst CVE-2025-658317.5The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through e CVE-2025-658324.6The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has CVE-2025-658349.8Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipul CVE-2025-658356.2The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receive CVE-2025-658369.1PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.CVE-2025-658375.4PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.CVE-2025-658387.5PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.CVE-2025-658408.8PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController.