PT-2025-18711 · Alanbinu007 · Spring-Boot-Advanced-Projects

Name of the Vulnerable Software and Affected Versions: AlanBinu007 Spring-Boot-Advanced-Projects versions up to 3.1.3 Description: A critical vulnerability was found in AlanBinu007 Spring-Boot-Advanced-Projects, affecting the function uploadUserProfileImage of the file...

Spring-Boot-Advanced-Projects: Path traversal vulnerabilities

Spring-Boot-Advanced-Projects is a Spring Boot application by Alan Binu, an individual developer. A path traversal vulnerability exists in Spring-Boot-Advanced-Projects 3.1.3 and earlier versions, which stems from an incorrect operation of the file upload feature that results in path traversal...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +15 more potentially affected by CVE-2025-3910 via org.keycloak:keycloak-services (24.0.5)

org.keycloak:keycloak-services MAVEN version 24.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 -...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), br.com.anteros:anteros-jsondoc-springboot (1.0.0) +313 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.3.release)

org.springframework.boot:spring-boot MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - biz.grundner.vaadin-in-spring:spring-vaadin 1.0 -...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-cluster (>=0.0.10, <=0.1.14) +196 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.2.release)

org.springframework.boot:spring-boot MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =0.0.5, =0.0.5, =0.1.8, =0.0.10,...

cc.catalysts.boot:cat-boot-javamelody (0.0.4), cn.bestwu:data-rest (1.0.0.m1) +191 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.1.release)

org.springframework.boot:spring-boot MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.catalysts.boot:cat-boot-javamelody 0.0.4 - cn.bestwu:data-rest 1.0.0.m1 -...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +324 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.0.release)

org.springframework.boot:spring-boot MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter =0.1.6,...

com.foreach.across.modules:admin-web-module (1.1.1.release), com.foreach.across.modules:debug-web-module (1.0.1.release) +131 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.8.release)

org.springframework.boot:spring-boot MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.foreach.across.modules:admin-web-module 1.1.1.release -...

com.aol.microservices:micro-boot (>=0.64, <=0.72), com.deviceatlas:deviceatlas-spring-mobile-extension (0.1.0) +146 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.7.release)

org.springframework.boot:spring-boot MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.aol.microservices:micro-boot =0.64, =1.17, =1.25.1-release, =0.1, =1.0,...

com.github.advantageous:qbit-spring (>=0.9.1-rc11, <=0.9.2-rc14), com.github.jmgilmour:parker-spring-boot (0.1.0) +165 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.6.release)

org.springframework.boot:spring-boot MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.advantageous:qbit-spring =0.9.1-rc11, =2.0.1, =2.2.29, =1.0.4, =1.0....

cn.afterturn:easypoi-spring-boot-starter (>=0.2, <=3.3.0), co.paralleluniverse:comsat-spring-boot (0.5.0) +251 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.5.release)

org.springframework.boot:spring-boot MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.afterturn:easypoi-spring-boot-starter =0.2, =1.5.0, =2.0.2, =2.0.3, =2.0.2,...

co.paralleluniverse:comsat-spring-boot (0.4.0), co.paralleluniverse:comsat-spring-boot-security (0.4.0) +124 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.4.release)

org.springframework.boot:spring-boot MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.4.0 -...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +7546 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.4)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2025-22235 Source advisory: OSV:GHSA-RC42-6C7J-7H5R...

com.github.microwww:mocker-redis-spring-boot-autoconfigure (>=0.0.1, <=3.0.0), com.github.microwww:mocker-redis-spring-boot-starter (>=0.0.1, <=3.0.2-2.8) +79 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.0.release)

org.springframework.boot:spring-boot MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.microwww:mocker-redis-spring-boot-autoconfigure =0.0.1, =0.0.1,...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +7546 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.4)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2025-22235 Source advisory: GHSA-RC42-6C7J-7H5R...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), at.researchstudio.sat:won-matcher (>=0.4, <=0.6) +174 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.17.release)

org.springframework.boot:spring-boot MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +267 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.19.release)

org.springframework.boot:spring-boot MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop =1.5.19.release, =1.5.19.release,...

cn.skylarkai:license (>=1.0.0, <=1.0.2), com.eworkcloud:ework-cloud-starter-web (>=1.0.0, <=1.8.1) +175 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.20.release)

org.springframework.boot:spring-boot MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.skylarkai:license =1.0.0, =1.0.0, =3.1.1.release, =2.2.0.release,...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +266 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.21.release)

org.springframework.boot:spring-boot MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure 1.0.2 -...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +37016 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.6.0.0 and more Source cves: CVE-2025-22235 Source advisory: OSV:GHSA-RC42-6C7J-7H5R...