CVE-2025-10759

Katalog CVE

CVSS 5.3 · Medium EPSS 0,35%

Kerentanan Improper Authorization pada webkul qloapps. Skor CVSS 3.1 5.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."

Rincian

Terbit di NVD

21 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md exploit · advisory pihak ketiga
• https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md#proo... exploit · advisory pihak ketiga
• https://vuldb.com/?id.325114 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.645821 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.325114 permissions required · vdb entry