CVE-2025-10014

Katalog CVE

CVSS 3.1 · Low EPSS 0,28%

Kerentanan Incorrect Privilege Assignment pada eladmin. Skor CVSS 3.1 3.1 (Low) menurut vuldb.com.

Deskripsi (NVD)

A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.

Rincian

Terbit di NVD

5 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.322739 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.643840 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.322739 permissions required · vdb entry
• https://www.cnblogs.com/aibot/p/19063332 broken link