CVE-2025-9031

MediumCVSS 4.3/10Last modified Sep 26, 2026

Description

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.

This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203CWE-208

Affected software

No affected versions have been published.

Timeline

Published
Sep 24, 2025
Last modified
Sep 26, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-90327.8Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution oCVE-2025-90337.8Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code CVE-2025-90346.1The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leadinCVE-2025-90355.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies InCVE-2025-90368.5A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted oCVE-2025-90387.5Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue CVE-2025-90394.3We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by anotheCVE-2025-90418.7A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the CVE-2025-90428.7A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the CVE-2025-90436.7The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploitCVE-2025-90446.4The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, CVE-2025-90456.4The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less t
CVE-2025-9031: Medium severity, CVSS 4.3 | Vulnix