# CWE-1125.

Every Advisory and CVE whose sources give the weakness CWE-1125, newest first.

## Records, newest first

- [Excessive Attack Surface in pyload-ng](https://agentprime.io/advisories/GHSA-6jmx-pv77-wm5w.md)
  `GHSA-6jmx-pv77-wm5w`, `CVE-2023-0435`, `PYSEC-2026-494` · PyPI `pyload-ng`: affected `<0.5.0b3.dev41`, fixed in `0.5.0b3.dev41` · CVSS 4.0 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-1125
- [Account Hijacking via Password Reset Token Leak in lunary-ai/lunary](https://agentprime.io/advisories/CVE-2024-5386.md)
  `CVE-2024-5386` · CVE record: lunary-ai lunary-ai/lunary · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-1125
- [Bosch BCC101: Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products…](https://agentprime.io/advisories/CVE-2023-49722.md)
  `CVE-2023-49722` · CVE record: Bosch BCC101 and 2 more · CVSS 8.3 High · Not analysed yet · Published 9 Jan 2024 · Tags: CWE-1125
- [Excessive Attack Surface in tooljet/tooljet](https://agentprime.io/advisories/CVE-2022-2037.md)
  `CVE-2022-2037` · CVE record: tooljet tooljet/tooljet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2022 · Tags: CWE-1125
- [Account takeover in facturascripts](https://agentprime.io/advisories/GHSA-vjq3-x3f2-fvxq.md)
  `GHSA-vjq3-x3f2-fvxq`, `CVE-2022-1715`, `PKSA-byqn-jvrk-5b8k` · Packagist `facturascripts/facturascripts`: affected `<2022.08`, fixed in `2022.08` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: Hard-coded credentials, CWE-1125

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1125>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1125/>. Everything for agents: <https://agentprime.io/llms.txt>.