CVE-2025-57805: high-severity vulnerability in The-Scratch-Channel tsc-web-client
The Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any category with any date, regardless of who's logged in. This issue has been patched in version 1.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
The-Scratch-Channel · tsc-web-clientRelated CVEs — The-Scratch-Channel tsc-web-client
In the same product, most dangerous first.