CVE-2025-43703 - CVE House
Back to Database
Status published Medium CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A...

Vulnerability Description

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-43703

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ankitects

View All →
CVE-2025-62187
In Ankitects Anki before 25.02.6, crafted sound file references could...
Low 2.9
CVE-2025-62186
Ankitects Anki before 25.02.5 allows a crafted shared deck on...
Medium 6.7
CVE-2025-62185
In Ankitects Anki before 25.02.5, a crafted shared deck can...
Medium 6.7
CVE-2024-32484
An reflected XSS vulnerability exists in the handling of invalid...
High 7.4
CVE-2024-32152
A blocklist bypass vulnerability exists in the LaTeX functionality of...
Low 3.1

Affected Vendor

Affected Software

Anki
Vulnerable Versions:
0

Timeline

Official Publish: April 16th, 2025
Last Modified: April 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-830

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.