What’s Vulnerable › Vulnerabilities

CVE-2025-29036

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-01 · updated 2026-06-17
• Weakness: CWE-266

Description

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.

References

• https://github.com/HypeDuke/vulnerable-research/blob/main/CVE-2025-29036
• https://github.com/sahat/hackathon-starter/issues/1326
• https://github.com/sahat/hackathon-starter/pull/1328

Get alerted when CVE-2025-29036 or the next vulnerability affects your stack