CVE-2025-57754
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.36%
- CWE
- CWE-260
- Published
- 2025-08-21
- Last modified
- 2026-03-13
Affected products
- kristoferfannar eslint-ban-moment
Weakness type
Related vulnerabilities
- CVE-2019-25465 — Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
- CVE-2025-15151 — TaleLin Lin-CMS Tests Folder config.py password in configuration file
- CVE-2023-53770 — MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
- CVE-2023-53739 — Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
- CVE-2025-33119 — IBM QRadar SIEM Information Disclosure
- CVE-2025-36002 — IBM Sterling B2B Integrator information disclosure
- CVE-2025-36100 — IBM MQ information disclosure
- CVE-2025-6513 — BRAIN2 Configuration file for database access not sufficiently secured