CVE-2025-62784
InventoryGui allows item duplication in GUIs which use GuiStorageElement
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 27, 2025
- Updated
- Oct 28, 2025
- Reserved
- Oct 22, 2025
Description
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.5.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | GitHub_M |
Weaknesses
- CWE-837 Improper Enforcement of a Single, Unique Action
Affected Products
| Product | Versions |
|---|---|
InventoryGuiPhoenix616 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.