Skip to content
OpenAdvisories

Vendor

rommapp

5 known vulnerabilities.

Products

romm 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2025-65097

    Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

    RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE …

    rommapp romm
  • High 7.6
    CVE-2025-65027 Public exploit

    RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

    RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files…

    rommapp romm
  • High 8.3
    CVE-2025-53908

    RomM vulnerable to Authenticated Path Traversal

    RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, s…

    rommapp romm