PT-2025-44049 · Unknown · Inventorygui

Published 2025-10-27 · Updated 2026-02-13 · CVE-2025-62784

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions InventoryGui versions prior to 1.6.5

Description InventoryGui is a library used for creating chest GUIs for Bukkit/Spigot plugins. A flaw exists in versions before 1.6.5 where item duplication can occur. This happens when a plugin utilizes a GUI with the GuiStorageElement and allows items to be removed from that element, specifically when the server’s experimental Bundle item feature is enabled.

Recommendations Versions prior to 1.6.5 should be updated to version 1.6.5.

Exploit

Fix

Weakness Enumeration

CWE-837

Related Identifiers

CVE-2025-62784

GHSA-7WHH-79J3-7C55

Affected Products

Inventorygui

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62784.json · Exploit
• https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9 · Patch
• https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55 · Patch
• https://osv.dev/vulnerability/CVE-2025-62784 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7whh-79j3-7c55 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62784 · Security Note
• https://github.com/Phoenix616/InventoryGui · Note
• https://t.me/cveNotify/141589 · Telegram Post
• https://t.me/CVEtracker/35898 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983036402624266734 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oj4i5j/resumen_diario_de_vulnerabilidades_29102025 · Reddit Post
• https://twitter.com/transilienceai/status/2022151608310681784 · Twitter Post