VulnerabilityDeferred

CVE-2025-11945

A vulnerability was identified in toeverything AFFiNE up to 0.24.1.

LOW 2.0EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0: 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-94
Source: cna@vuldb.com

References

https://drive.google.com/file/d/1L6gX0GY8cE9rS6o50oJzuMRPVMerFQNS
https://vuldb.com/?ctiid.329025
https://vuldb.com/?id.329025
https://vuldb.com/?submit.670888

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.