CVE-2025-14516

Yalantis uCrop 2.2.11 contains a Server-Side Request Forgery (SSRF) in the URL Handler: downloadFile() in com.yalantis.ucrop.task.BitmapLoadTask.java. Manipulation allows remote-triggered requests, with disclosure publicly available and vendor not responding. Multiple sources (NVD, Red Hat, CVE l...

CVE-2025-14517

CVE-2025-14517 affects Yalantis uCrop 2.2.11 and concerns the UCropActivity component defined in AndroidManifest.xml. The vulnerability arises from an improper export of Android application components, which could allow manipulation to lead to exposure of components outside the intended scope. Ex...