VULNERABILITY INTELLIGENCE
CVE-2025-12854
CVSS score3.7 LOW
EPSS probability0.49%
CISA KEVNot currently listed
Published2025-11-07
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The manipulation of the argument userid leads to authorization bypass. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used.
Weakness classification
- cna@vuldb.com: CWE-285