CVE-2025-7515
published 2025-07-13CVE-2025-7515: A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.39%
31.5th percentile
A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file /ulocateus.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anisha | online_appointment_booking_system | — | — |
| authlib | authlib | >= 0 < 1.6.4 | 1.6.4 |
| code-projects | online_appointment_booking_system | — | — |
| pyjwt_project | pyjwt | >= 0 < 2.12.0 | 2.12.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyJWT accepts unknown `crit` header extensions
ghsa·2026-03-13·CVSS 7.5
CVE-2026-32597 [HIGH] CWE-345 PyJWT accepts unknown `crit` header extensions
PyJWT accepts unknown `crit` header extensions
## Summary
PyJWT does not validate the `crit` (Critical) Header Parameter defined in
RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing
extensions that PyJWT does not understand, the library accepts the token
instead of rejecting it. This violates the **MUST** requirement in the RFC.
This is the same class of vulnerability as CVE-2025-59420 (Authlib),
which received CVSS 7.5 (HIGH).
---
## RFC Requirement
RFC 7515 §4.1.11:
> The "crit" (Critical) Header Parameter indicates that extensions to this
> specification and/or [JWA] are being used that **MUST** be understood and
> processed. [...] If any of the listed extension Header Parameters are
> **not understood and supported** by the recipient, then the **JWS is invalid**
GHSA
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
ghsa·2025-09-22
CVE-2025-59420 [HIGH] CWE-345 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
## Summary
Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (`crit`), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, `bork` or `cnf`) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.
## Affected Component and Versions
- Library: Authlib (JWS verification)
- API: `authlib.jose.JsonWebSignature.deserialize_compact(...)`
- Version tested: 1.6.3
- Configuration: Default; no allowlist or special handling for `crit`
## Details
RFC 7515 (JWS) §4.1.11 defines `crit` as
GHSA
GHSA-22jv-4f49-gfvh: A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1
ghsa_unreviewed·2025-07-13
CVE-2025-7515 [MEDIUM] CWE-74 GHSA-22jv-4f49-gfvh: A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1
A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file /ulocateus.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Red Hat
authlib: Authlib RFC violation
vendor_redhat·2025-09-22·CVSS 7.5
CVE-2025-59420 [HIGH] CWE-440 authlib: Authlib RFC violation
authlib: Authlib RFC violation
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.
Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-13
Published