CVE-2025-1007

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

• CWE-283
• CWE-285

• https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4hExploit, Vendor Advisory

Published

Feb 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10063A vulnerability was identified in itsourcecode POS Point of …6.1
• CVE-2025-10064A security flaw has been discovered in itsourcecode POS Poin…6.1
• CVE-2025-10065A weakness has been identified in itsourcecode POS Point of …6.1
• CVE-2025-10066A security vulnerability has been detected in itsourcecode P…6.1
• CVE-2025-10067A vulnerability was detected in itsourcecode POS Point of Sa…6.1
• CVE-2025-10068A flaw has been found in itsourcecode Online Discussion Foru…9.8
• CVE-2025-10070A flaw has been found in Portabilis i-Educar up to 2.10. Thi…6.3
• CVE-2025-10071A vulnerability has been found in Portabilis i-Educar up to …6.3
• CVE-2025-10072A vulnerability was found in Portabilis i-Educar up to 2.10.…6.3
• CVE-2025-10073A vulnerability was determined in Portabilis i-Educar up to …4.3
• CVE-2025-10074A vulnerability was identified in Portabilis i-Educar up to …5.4
• CVE-2025-10075A security flaw has been discovered in SourceCodester Online…5.4