CVE-2025-57805CWE-20

The Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation

High · published August 25, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any category with any date, regardless of who's logged in. This issue has been patched in version 1.2.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00322 · 24.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-08-25T21:15Z
EPSS history
Timeline
  • 25 AUG 21:15Z
    The Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation
    cvelistv5