Vulnerability-Lookup

CVE-2025-7362 (GCVE-0-2025-7362)

Vulnerability from cvelistv5 – Published: 2025-07-08 17:22 – Updated: 2025-07-10 13:19

Title

MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message

Summary

The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-10 13:19 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

wikimedia-foundation mitre root

References

2 references

URL	Tags
https://phabricator.wikimedia.org/T394864
https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926e…

Impacted products

1 product

Vendor	Product	Version	CPE status
Wikimedia Foundation	Mediawiki - MsUpload extension	Affected: 1.39.x , < 1.39.13 (semver) Affected: 1.42.x , < 1.42.7 (semver) Affected: 1.43.x , < 1.43.2 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7362",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-10T13:19:17.654293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-10T13:19:38.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://phabricator.wikimedia.org/T394864"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - MsUpload extension",
          "vendor": "Wikimedia Foundation",
          "versions": [
            {
              "lessThan": "1.39.13",
              "status": "affected",
              "version": "1.39.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.42.7",
              "status": "affected",
              "version": "1.42.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.43.2",
              "status": "affected",
              "version": "1.43.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\u003c/p\u003e\n\n\n\u003cp\u003eThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.\u003c/p\u003e"
            }
          ],
          "value": "The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\n\n\n\n\nThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T17:22:35.364Z",
        "orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "shortName": "wikimedia-foundation"
      },
      "references": [
        {
          "url": "https://phabricator.wikimedia.org/T394864"
        },
        {
          "url": "https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
    "assignerShortName": "wikimedia-foundation",
    "cveId": "CVE-2025-7362",
    "datePublished": "2025-07-08T17:22:35.364Z",
    "dateReserved": "2025-07-08T17:18:05.309Z",
    "dateUpdated": "2025-07-10T13:19:38.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-7362",
      "date": "2026-09-15",
      "epss": "0.00174",
      "percentile": "0.07078"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-7362\",\"sourceIdentifier\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"published\":\"2025-07-08T18:15:46.797\",\"lastModified\":\"2026-06-17T10:04:47.213\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\\n\\n\\n\\n\\nThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.\"},{\"lang\":\"es\",\"value\":\"La extensi\u00f3n MsUpload para MediaWiki es vulnerable a XSS almacenado mediante el mensaje de sistema msu-continue, que se inserta en el DOM sin la debida limpieza. La vulnerabilidad se produce en la interfaz de carga de archivos cuando se carga el mismo nombre de archivo dos veces. Este problema afecta a Mediawiki - extensi\u00f3n MsUpload: desde la versi\u00f3n 1.39.X hasta la 1.39.13, desde la versi\u00f3n 1.42.X hasta la 1.42.7, desde la versi\u00f3n 1.43.X hasta la 1.43.2.\"}],\"affected\":[{\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"affectedData\":[{\"vendor\":\"Wikimedia Foundation\",\"product\":\"Mediawiki - MsUpload extension\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.39.x\",\"lessThan\":\"1.39.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.42.x\",\"lessThan\":\"1.42.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.43.x\",\"lessThan\":\"1.43.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-07-10T13:19:17.654293Z\",\"id\":\"CVE-2025-7362\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f\",\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"},{\"url\":\"https://phabricator.wikimedia.org/T394864\",\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"},{\"url\":\"https://phabricator.wikimedia.org/T394864\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-07-10T18:24:35+00:00",
      "cve": "CVE-2025-7362",
      "id": "CVE-2025-7362",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-7362.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-7362\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-10T13:19:17.654293Z\"}}}], \"references\": [{\"url\": \"https://phabricator.wikimedia.org/T394864\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-10T13:19:35.707Z\"}}], \"cna\": {\"title\": \"MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"affected\": [{\"vendor\": \"Wikimedia Foundation\", \"product\": \"Mediawiki - MsUpload extension\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.39.x\", \"lessThan\": \"1.39.13\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.42.x\", \"lessThan\": \"1.42.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.43.x\", \"lessThan\": \"1.43.2\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://phabricator.wikimedia.org/T394864\"}, {\"url\": \"https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\\n\\n\\n\\n\\nThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\u003c/p\u003e\\n\\n\\n\u003cp\u003eThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"shortName\": \"wikimedia-foundation\", \"dateUpdated\": \"2025-07-08T17:22:35.364Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-7362\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-10T13:19:38.972Z\", \"dateReserved\": \"2025-07-08T17:18:05.309Z\", \"assignerOrgId\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"datePublished\": \"2025-07-08T17:22:35.364Z\", \"assignerShortName\": \"wikimedia-foundation\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-7362

Vulnerability from fkie_nvd - Published: 2025-07-08 18:15 - Updated: 2026-06-17 10:04

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f
	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	https://phabricator.wikimedia.org/T394864
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://phabricator.wikimedia.org/T394864

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - MsUpload extension",
          "vendor": "Wikimedia Foundation",
          "versions": [
            {
              "lessThan": "1.39.13",
              "status": "affected",
              "version": "1.39.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.42.7",
              "status": "affected",
              "version": "1.42.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.43.2",
              "status": "affected",
              "version": "1.43.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\n\n\n\n\nThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2."
    },
    {
      "lang": "es",
      "value": "La extensi\u00f3n MsUpload para MediaWiki es vulnerable a XSS almacenado mediante el mensaje de sistema msu-continue, que se inserta en el DOM sin la debida limpieza. La vulnerabilidad se produce en la interfaz de carga de archivos cuando se carga el mismo nombre de archivo dos veces. Este problema afecta a Mediawiki - extensi\u00f3n MsUpload: desde la versi\u00f3n 1.39.X hasta la 1.39.13, desde la versi\u00f3n 1.42.X hasta la 1.42.7, desde la versi\u00f3n 1.43.X hasta la 1.43.2."
    }
  ],
  "id": "CVE-2025-7362",
  "lastModified": "2026-06-17T10:04:47.213",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7362",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-10T13:19:17.654293Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-08T18:15:46.797",
  "references": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "url": "https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f"
    },
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "url": "https://phabricator.wikimedia.org/T394864"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://phabricator.wikimedia.org/T394864"
    }
  ],
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "type": "Secondary"
    }
  ]
}

GHSA-PQMG-6GRF-RG8C

Vulnerability from github – Published: 2025-07-08 18:31 – Updated: 2025-07-10 15:31

Details

This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-7362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T18:15:46Z",
    "severity": "MODERATE"
  },
  "details": "The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.\n\n\n\n\nThis issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.",
  "id": "GHSA-pqmg-6grf-rg8c",
  "modified": "2025-07-10T15:31:16Z",
  "published": "2025-07-08T18:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7362"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T394864"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2025-1525

Vulnerability from csaf_certbund - Published: 2025-07-09 22:00 - Updated: 2025-07-23 22:00

Summary

MediaWiki Extensions und Skins: Mehrere Schwachstellen

Severity

Hoch

Scope

42 vulnerabilities in this advisory, including CVE-2025-7362.

CVE-2025-7362

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-7362 (GCVE-0-2025-7362)

FKIE_CVE-2025-7362

GHSA-PQMG-6GRF-RG8C

WID-SEC-W-2025-1525

Tags

Sightings

Nomenclature