CVE-2025-9288

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
——<= 2.4.11

References

Timeline

Published
Aug 20, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-92894.7A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. ExploitatiCVE-2025-92905.9An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handlCVE-2025-92916.5A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verifCVE-2025-92927.5A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumCVE-2025-92938.1A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities durCVE-2025-92944.3The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missiCVE-2025-92969.8A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?actionCVE-2025-92978.8A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. PCVE-2025-92989.8A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation oCVE-2025-92999.8A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of theCVE-2025-93007.8A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file srcCVE-2025-93013.3A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file c
CVE-2025-9288: Critical severity, CVSS 9.1 | Vulnix