CVE-2025-54428

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.

• CWE-522

• https://github.com/musombi123/RevelaCode-Backend/commit/95005cf4bacf1b005aef9d4b8e85237c98492d83
• https://github.com/musombi123/RevelaCode-Backend/security/advisories/GHSA-m253-qvcr-cr48

Published

Jul 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54422Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
• CVE-2025-54423copyparty is a portable file server. In versions up to and i…6.1
• CVE-2025-544241Panel is a web interface and MCP Server that manages websit…9.8
• CVE-2025-54425Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2…5.3
• CVE-2025-54426Polkadot Frontier is an Ethereum and EVM compatibility layer…9.9
• CVE-2025-54427Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
• CVE-2025-54429Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
• CVE-2025-5443A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-54430dedupe is a python library that uses machine learning to per…9.1
• CVE-2025-54432Rejected reason: This CVE is a duplicate of another CVE. See…
• CVE-2025-54433Bugsink is a self-hosted error tracking service. In versions…7.2
• CVE-2025-54438Improper Limitation of a Pathname to a Restricted Directory …9.8