VULNERABILITY INTELLIGENCE
CVE-2025-60375
CVSS score7.3 HIGH
EPSS probability0.28%
CISA KEVNot currently listed
Published2025-10-09
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-289