CVE-2025-63800

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Weak Password Requirements pada opensourcepos open source point of sale. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.

Rincian

Terbit di NVD

18 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-521: Weak Password Requirements

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/omkaryepre/vulnerability-research/tree/main/CVE-2025-63800 exploit · advisory pihak ketiga
• https://github.com/opensourcepos/opensourcepos product
• https://opensourcepos.org/ product