CVE-2025-5325

Katalog CVE

CVSS 9.8 · Critical EPSS 0,51%

Kerentanan Incomplete Filtering of Special Elements pada zhilink adp application developer platform. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

29 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-791: Incomplete Filtering of Special Elements
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.310495 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.581275 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.310495 permissions required · vdb entry