CVE-2025-43703CWE-830

An issue was discovered in Ankitects Anki through 25.02

Medium · published April 16, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-830 · Inclusion of Web Functionality from an Untrusted Source
Published
2025-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    An issue was discovered in Ankitects Anki through 25.02
    cvelistv5