MEDIUM🇵🇱 Wersja polska

CVE-2025-43703

CVSS 6.1v3.1pub. 2025-04-16upd. 2025-10-09

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • Ankitects Anki

    APP
    Ankitects
    ≤ 25.02
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-32484HIGH7.4same product

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 2...

CVE-2025-62185MEDIUM6.7same product

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media...

CVE-2025-62186MEDIUM6.7same product

Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playi...

CVE-2025-62187LOW2.9same product

W Ankitects Anki przed wersją 25.02.6 spreparowane odwołania do plików dźwiękowych mogły spowodować zapis plik...

CVE-2024-32152LOW3.1same product

W funkcjonalności LaTeX aplikacji Ankitects Anki 24.04 istnieje podatność umożliwiająca obejście blokady. Spec...