CVE-2025-2589

Katalog CVE

CVSS 9.8 · Critical EPSS 0,46%

Kerentanan Incorrect Privilege Assignment pada code-projects human resource management. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to improper authorization. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

21 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization
CWE-862: Missing Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?submit.517343 advisory pihak ketiga · vdb entry
• https://github.com/38279/1/issues/1 exploit
• https://code-projects.org/ product
• https://vuldb.com/?ctiid.300569 permissions required · vdb entry
• https://vuldb.com/?id.300569 permissions required · vdb entry