{"id":"CVE-2025-48757","aliases":["EUVD-2025-16441","GHSA-773x-pxjg-gxgx"],"status":"disputed","title":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote...","description":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00833,"percentile":0.58085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-863"],"published":"2025-05-30T00:00:00Z","modified":"2026-06-17T09:30:17Z","exploits":[{"source":"pocgithub","id":"boxed-dev/vibe-coding-security","title":"boxed-dev/vibe-coding-security","date":"2026-05-01","url":"https://github.com/boxed-dev/vibe-coding-security"},{"source":"pocgithub","id":"git-akki/cso-vibecheck","title":"git-akki/cso-vibecheck","date":"2026-05-01","url":"https://github.com/git-akki/cso-vibecheck"}],"products":[{"vendor":"lovable","product":"lovable"}],"references":[{"url":"https://docs.lovable.dev/changelog"},{"url":"https://mattpalmer.io/posts/CVE-2025-48757/"},{"url":"https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9","tags":["exploit"]},{"url":"https://x.com/danialasaria/status/1911862269996118272"},{"url":"https://mattpalmer.io/posts/statement-on-CVE-2025-48757/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48757"},{"url":"https://mattpalmer.io/posts/CVE-2025-48757"},{"url":"https://mattpalmer.io/posts/statement-on-CVE-2025-48757"},{"url":"https://github.com/advisories/GHSA-773x-pxjg-gxgx"}],"sources":{"cve":[{"id":"CVE-2025-48757","description":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.","status":"disputed","published":"2025-05-30T00:00:00Z","modified":"2025-08-21T02:28:45.607Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-16441","description":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2025-08-21T02:28:45Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"updated_at":"2026-11-02T20:31:55.037702Z"}],"ghsa":[{"id":"GHSA-773x-pxjg-gxgx","title":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote...","description":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites.","status":"published","published":"2025-05-30T03:30:32Z","modified":"2025-06-11T21:33:02Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:02:42.160981Z"}],"nvd":[{"id":"CVE-2025-48757","description":"An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.","status":"disputed","published":"2025-05-30T03:15:20.893Z","modified":"2026-06-17T09:30:17.293Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:10.143444Z"}]}}