{"metadata": {"vulnerability": "cve-2025-31137", "count": 31, "kinds": {"milestone": 4, "sighting": 19, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-03-26T15:04:52.627Z", "date_only": false, "value": "2025-03-26T15:04:52.627Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-31137", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-04-01T18:20:32.660Z", "date_only": false, "value": "2025-04-01T18:20:32.660Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-31137", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-04-01T18:20:32.660Z", "date_only": false, "value": "2025-04-01T18:20:32.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-31137", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-01T18:32:39Z", "date_only": false, "value": "2025-04-01T18:32:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/9963", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "3c82d645-1428-44f4-bd89-888c536dbdf5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-31137\n\ud83d\udd25 CVSS Score: 7.5 (cvssV3_0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.\n\ud83d\udccf Published: 2025-04-01T18:20:32.660Z\n\ud83d\udccf Modified: 2025-04-01T18:20:32.660Z\n\ud83d\udd17 References:\n1. https://github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477", "url": "https://t.me/DarkWebInformer_CVEAlerts/9963"}, {"timestamp": "2025-04-01T19:15:45Z", "date_only": false, "value": "2025-04-01T19:15:45Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4Q56-CRQP-V477", "record": "GHSA-4Q56-CRQP-V477", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-04-01T19:15:45.663Z", "date_only": false, "value": "2025-04-01T19:15:45.663", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31137", "record": "FKIE_CVE-2025-31137", "field": "published"}, {"timestamp": "2025-04-01T19:36:44.132Z", "date_only": false, "value": "2025-04-01T19:36:44.132617Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114264388612256212", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "8f49a193-a346-4abe-9b84-e048a1747bc2", "url": "https://infosec.exchange/users/cR0w/statuses/114264388612256212"}, {"timestamp": "2025-04-01T19:36:44.134Z", "date_only": false, "value": "2025-04-01T19:36:44.134042Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114264388612256212", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "b9375aaa-f5ef-45fe-b499-1a462eb9fe66", "url": "https://infosec.exchange/users/cR0w/statuses/114264388612256212"}, {"timestamp": "2025-04-01T22:15:41Z", "date_only": false, "value": "2025-04-01T22:15:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/21799", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "9aad20f3-fc67-49f6-a484-5ec50e145ef7", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-31137 - Remix/React Router URL Spoofing Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-31137 \nPublished : April 1, 2025, 7:15 p.m. | 25\u00a0minutes ago \nDescription : React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/21799"}, {"timestamp": "2025-04-01T22:23:33Z", "date_only": false, "value": "2025-04-01T22:23:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4Q56-CRQP-V477", "record": "GHSA-4Q56-CRQP-V477", "field": "published"}, {"timestamp": "2025-04-01T22:23:33Z", "date_only": false, "value": "2025-04-01T22:23:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4Q56-CRQP-V477", "record": "GHSA-4Q56-CRQP-V477", "field": "modified"}, {"timestamp": "2025-04-02T15:10:40.932Z", "date_only": false, "value": "2025-04-02T15:10:40.932074Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-31137", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-04-02T15:10:40.932Z", "date_only": false, "value": "2025-04-02T15:10:40.932074Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31137", "record": "FKIE_CVE-2025-31137", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-02T15:11:11.594Z", "date_only": false, "value": "2025-04-02T15:11:11.594Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-31137", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-04-02T15:11:11.594Z", "date_only": false, "value": "2025-04-02T15:11:11.594Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-31137", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-03T06:02:12.751Z", "date_only": false, "value": "2025-04-03T06:02:12.751794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3llva3g6nzb2j", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "87c8a6f5-45de-492a-8bf6-3cf0bae2f02b", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3llva3g6nzb2j"}, {"timestamp": "2025-04-03T08:08:19.661Z", "date_only": false, "value": "2025-04-03T08:08:19.661467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/andranglin.bsky.social/post/3llvh4u3jhc2s", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "84469591-2a35-4542-a94e-b66778d7a84c", "url": "https://bsky.app/profile/andranglin.bsky.social/post/3llvh4u3jhc2s"}, {"timestamp": "2025-04-03T18:57:15.324Z", "date_only": false, "value": "2025-04-03T18:57:15.324144Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/slymb.net/post/3llwlf53yrs2e", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "f4e87b98-7bf9-44ff-8e10-986c98829b69", "url": "https://bsky.app/profile/slymb.net/post/3llwlf53yrs2e"}, {"timestamp": "2025-04-04T00:15:06.334Z", "date_only": false, "value": "2025-04-04T00:15:06.334340Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3llx55dvlck2a", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "67954322-d449-4fcb-8688-c824cc9fcff0", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3llx55dvlck2a"}, {"timestamp": "2025-04-06T06:11:04.303Z", "date_only": false, "value": "2025-04-06T06:11:04.303905Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycipher.bsky.social/post/3lm4rxzkid22o", "record": "cve-2025-31137", "field": "creation_timestamp", "uuid": "60a95730-64b0-4a7e-9e53-c5caec9ce2c6", "url": "https://bsky.app/profile/securitycipher.bsky.social/post/3lm4rxzkid22o"}, {"timestamp": "2025-04-17T20:14:01.325Z", "date_only": false, "value": "2025-04-17T20:14:01.325799Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/feedbot.unronritaro.net/post/3lmzw7gaugj2u", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "8a7b84f9-d2d1-4de4-96fb-a39a863058a1", "url": "https://bsky.app/profile/feedbot.unronritaro.net/post/3lmzw7gaugj2u"}, {"timestamp": "2025-04-18T09:00:06.081Z", "date_only": false, "value": "2025-04-18T09:00:06.081484Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/rss.y-u-e.workers.dev/post/3ln3azc3paf2b", "record": "cve-2025-31137", "field": "creation_timestamp", "uuid": "b0a12f19-8a19-46e3-8625-a12c0dfd3627", "url": "https://bsky.app/profile/rss.y-u-e.workers.dev/post/3ln3azc3paf2b"}, {"timestamp": "2025-04-23T21:00:07Z", "date_only": false, "value": "2025-04-23T21:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/m_VX8ITBtSBz-wC_458XeKLmc3TfY-HOZ02yPgCyfuW9sk0", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "90123b3a-ba9f-4b2b-98ac-4f50a179035e"}, {"timestamp": "2025-04-25T05:30:38.344Z", "date_only": false, "value": "2025-04-25T05:30:38.344794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kriware.bsky.social/post/3lnmil7z3l22g", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "7e693e1e-427a-44ca-8357-5d6d398a2d5d", "url": "https://bsky.app/profile/kriware.bsky.social/post/3lnmil7z3l22g"}, {"timestamp": "2025-08-03T21:02:42.919Z", "date_only": false, "value": "2025-08-03T21:02:42.919920Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvjlbvgsji25", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "23aa2a93-a20d-4dd5-a8b5-3c5f18dcf414", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvjlbvgsji25"}, {"timestamp": "2026-06-17T09:09:55.317Z", "date_only": false, "value": "2026-06-17T09:09:55.317", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31137", "record": "FKIE_CVE-2025-31137", "field": "lastModified"}, {"timestamp": "2026-08-14T16:00:20.249Z", "date_only": false, "value": "2026-08-14T16:00:20.249921Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/462", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "f29c16d9-9bfc-4032-a9db-ae5317183b73", "url": "https://t.me/purp_sec/462"}, {"timestamp": "2026-09-01T20:00:25.288Z", "date_only": false, "value": "2026-09-01T20:00:25.288662Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/156782", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "cb50cd7a-c5b8-4969-bdbd-a129a877a6ce", "url": "https://t.me/hacking_Attack/156782"}, {"timestamp": "2026-09-01T20:00:25.337Z", "date_only": false, "value": "2026-09-01T20:00:25.337694Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/156784", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "3634e242-6bef-4df7-b22a-982b90a7e73a", "url": "https://t.me/hacking_Attack/156784"}, {"timestamp": "2026-09-03T11:00:04.375Z", "date_only": false, "value": "2026-09-03T11:00:04.375923Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/156784", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "9bb774a6-5048-475c-b992-7c5071301f65", "url": "https://t.me/hacking_Attack/156784"}, {"timestamp": "2026-09-03T11:00:04.430Z", "date_only": false, "value": "2026-09-03T11:00:04.430630Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/156782", "record": "CVE-2025-31137", "field": "creation_timestamp", "uuid": "6f80c136-b9c2-4f47-b485-128b7ee3f608", "url": "https://t.me/hacking_Attack/156782"}]}