{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-11945",
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "state": "PUBLISHED",
        "assignerShortName": "VulDB",
        "dateReserved": "2025-10-19T02:58:55.406Z",
        "datePublished": "2025-10-19T21:02:06.115Z",
        "dateUpdated": "2025-10-22T20:35:41.136Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
                "shortName": "VulDB",
                "dateUpdated": "2025-10-19T21:02:06.115Z"
            },
            "title": "toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "type": "CWE",
                            "cweId": "CWE-79",
                            "lang": "en",
                            "description": "Cross Site Scripting"
                        }
                    ]
                },
                {
                    "descriptions": [
                        {
                            "type": "CWE",
                            "cweId": "CWE-94",
                            "lang": "en",
                            "description": "Code Injection"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "toeverything",
                    "product": "AFFiNE",
                    "versions": [
                        {
                            "version": "0.24.0",
                            "status": "affected"
                        },
                        {
                            "version": "0.24.1",
                            "status": "affected"
                        }
                    ],
                    "modules": [
                        "Avatar Upload Image Endpoint"
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
                },
                {
                    "lang": "de",
                    "value": "Es wurde eine Schwachstelle in toeverything AFFiNE up to 0.24.1 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Komponente Avatar Upload Image Endpoint. Die Manipulation führt zu cross site scripting. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "version": "4.0",
                        "baseScore": 5.1,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "baseScore": 3.5,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
                        "baseSeverity": "LOW"
                    }
                },
                {
                    "cvssV3_0": {
                        "version": "3.0",
                        "baseScore": 3.5,
                        "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
                        "baseSeverity": "LOW"
                    }
                },
                {
                    "cvssV2_0": {
                        "version": "2.0",
                        "baseScore": 4,
                        "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"
                    }
                }
            ],
            "timeline": [
                {
                    "time": "2025-10-19T00:00:00.000Z",
                    "lang": "en",
                    "value": "Advisory disclosed"
                },
                {
                    "time": "2025-10-19T02:00:00.000Z",
                    "lang": "en",
                    "value": "VulDB entry created"
                },
                {
                    "time": "2025-10-19T05:04:17.000Z",
                    "lang": "en",
                    "value": "VulDB entry last update"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "HAMZAOUI Mohamed (VulDB User)",
                    "type": "reporter"
                }
            ],
            "references": [
                {
                    "url": "https://vuldb.com/?id.329025",
                    "name": "VDB-329025 | toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting",
                    "tags": [
                        "vdb-entry"
                    ]
                },
                {
                    "url": "https://vuldb.com/?ctiid.329025",
                    "name": "VDB-329025 | CTI Indicators (IOB, IOC, TTP)",
                    "tags": [
                        "signature",
                        "permissions-required"
                    ]
                },
                {
                    "url": "https://vuldb.com/?submit.670888",
                    "name": "Submit #670888 | toeverything AFFiNE 0.24.1 Cross Site Scripting",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://drive.google.com/file/d/1L6gX0GY8cE9rS6o50oJzuMRPVMerFQNS",
                    "tags": [
                        "exploit"
                    ]
                }
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-10-20T16:46:40.858973Z",
                                "id": "CVE-2025-11945",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-10-22T20:35:41.136Z"
                }
            }
        ]
    }
}