CVE-2025-62782
NoneInventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement
CVSS
—
EPSS
0.3%
Published
Oct 27, 2025
CISA due date
—
The record
Any plugin using the GuiStorageElement is impacted when used on a server which allows the (currently experimental) Bundle items.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | de.themoep:inventorygui | 0 | 1.6.4-SNAPSHOT |
Related vulnerabilities
- CVE-2025-62784 InventoryGui allows item duplication in GUIs which use GuiStorageElement Also affects de.themoep:inventorygui
- CVE-2025-62783 InventoryGui affected by item duplication in GUIs which use GuiStorageElement Also affects de.themoep:inventorygui
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening fixes CWE-937
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections… CWE-937
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64 CWE-937
- GHSA-7cwm-fpfh-rrch Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces CWE-937