CVE-2025-14695

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14695", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-12-14T12:14:10.721Z", "datePublished": "2025-12-15T01:02:06.464Z", "dateUpdated": "2025-12-15T20:00:48.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-12-15T01:02:06.464Z"}, "title": "SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-913", "lang": "en", "description": "Dynamically-Managed Code Resources"}]}], "affected": [{"vendor": "SamuNatsu", "product": "HaloBot", "versions": [{"version": "026b01d4a896d93eaaf9d5163a287dc9f267515b", "status": "affected"}], "modules": ["Inter-plugin API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/html_renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code resources. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2025-12-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-12-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-12-14T13:19:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "qiushui (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.336413", "name": "VDB-336413 | SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.336413", "name": "VDB-336413 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.705587", "name": "Submit #705587 | SamuNatsu HaloBot 1.0 Improper Control of Dynamically-Managed Code Resources", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rassec2/dbcve/issues/20", "tags": ["exploit", "issue-tracking"]}], "tags": ["unsupported-when-assigned"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T19:58:40.347614Z", "id": "CVE-2025-14695", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T20:00:48.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14695", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T19:58:40.347614Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T20:00:37.449Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources", "credits": [{"lang": "en", "type": "reporter", "value": "qiushui (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "SamuNatsu", "modules": ["Inter-plugin API"], "product": "HaloBot", "versions": [{"status": "affected", "version": "026b01d4a896d93eaaf9d5163a287dc9f267515b"}]}], "timeline": [{"lang": "en", "time": "2025-12-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-12-14T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-12-14T13:19:27.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.336413", "name": "VDB-336413 | SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.336413", "name": "VDB-336413 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.705587", "name": "Submit #705587 | SamuNatsu HaloBot 1.0 Improper Control of Dynamically-Managed Code Resources", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rassec2/dbcve/issues/20", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/html_renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code resources. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-12-15T01:02:06.464Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14695", "state": "PUBLISHED", "dateUpdated": "2025-12-15T20:00:48.768Z", "dateReserved": "2025-12-14T12:14:10.721Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-12-15T01:02:06.464Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Inter-plugin API"], "product": "HaloBot", "vendor": "SamuNatsu", "versions": [{"status": "affected", "version": "026b01d4a896d93eaaf9d5163a287dc9f267515b"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/html_renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code resources. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en SamuNatsu HaloBot hasta 026b01d4a896d93eaaf9d5163a287dc9f267515b. Se ve afectada la funci\u00f3n html_renderer del archivo plugins/html_renderer/index.js del componente API Inter-plugin. La manipulaci\u00f3n del argumento action puede conducir a recursos de c\u00f3digo gestionados din\u00e1micamente. El ataque puede lanzarse remotamente. El exploit ha sido divulgado p\u00fablicamente y puede utilizarse. Este producto no utiliza versionado. Por esta raz\u00f3n, la informaci\u00f3n sobre las versiones afectadas y no afectadas no est\u00e1 disponible. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera. Esta vulnerabilidad solo afecta a productos que ya no cuentan con soporte por parte del mantenedor."}], "id": "CVE-2025-14695", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14695", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T19:58:40.347614Z", "version": "2.0.3"}}]}, "published": "2025-12-15T01:15:38.307", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/rassec2/dbcve/issues/20"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.336413"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.336413"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.705587"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-12-15T14:05:43.139413+00:00", "updated": "2025-12-15T14:05:43.139440+00:00", "vendors": ["samunatsu", "samunatsu$PRODUCT$halabot"]}