romm.app records
3 published records for vendor romm.app.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-284 Improper Access Control2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2025-65027Proof of concept | RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeoverromm.app · romm · CWE-79 | High7.6 | — | 0.3% | Dec 3, 2025 |
28Monitor | CVE-2025-65097No exploit | Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collectionsromm.app · romm · CWE-284 | High7.1 | — | 0.2% | Dec 3, 2025 |
21Monitor | CVE-2025-65096No exploit | RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collectionsromm.app · romm · CWE-284 | Medium5.3 | — | 0.1% | Dec 3, 2025 |
- CVE-2025-6502730Monitor
RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
HighCVSS 7.6Proof of conceptEPSS 0%romm.app · rommDec 3, 2025
- CVE-2025-6509728Monitor
Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
HighCVSS 7.1No exploitEPSS 0%romm.app · rommDec 3, 2025
- CVE-2025-6509621Monitor
RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections
MediumCVSS 5.3No exploitEPSS 0%romm.app · rommDec 3, 2025