Vulnerability · Published Aug 25, 2025 · Assigned by GitHub_M
CVE-2025-57805The Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation
High 8.7
In plain English
A high-severity improper input validation in tsc-web-client from The-Scratch-Channel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any category with any date, regardless of who's logged in. This issue has been patched in version 1.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The-Scratch-Channel | tsc-web-client | >= 1, < 1.2 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N