Advisories · Technology

romm.

Every CVE that names romm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-65097 CVE record

CVSS 7.1 High

Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
- romm
- Broken access control
Not analysed yet 3 Dec 2025
CVE-2025-65096 CVE record

CVSS 5.3 Medium

RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections
- romm
- Broken access control
Not analysed yet 3 Dec 2025
CVE-2025-65027 CVE record

CVSS 7.6 High

RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
- romm
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 3 Dec 2025
CVE-2025-54071 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution
- romm
- Unrestricted file upload
Not analysed yet 21 Jul 2025
CVE-2025-53908 CVE record

CVSS 8.3 High

RomM vulnerable to Authenticated Path Traversal
- romm
- CWE-26
Not analysed yet 16 Jul 2025