Stock Management System CVE-2025-14567

Exploitation requires only that a Stock-Management-System instance expose its HTTP API (specifically the /api/employees route) to the attacker's network; the vulnerability is that this endpoint enforces no authentication, so any party who can reach it can invoke it. No special configuration, feature flag, credentials, or user interaction is needed (AV:N/AC:L/PR:N/UI:N). The practical LIMITING factors are: the product must be deployed and network-reachable by the attacker, the affected code commit (up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0) must be running, and the product is unsupported with no official patch - mitigation requires manual code changes, access controls (e.g. reverse-proxy auth), or decommissioning rather than a vendor update. Impact is confined to data returned by that endpoint; no write or service-disruption capability is implied.

This is a low-to-moderate real-world risk despite several exploitation-friendly signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable flaw - network-accessible, low complexity, no authentication, no user interaction - but the impact is deliberately scoped to VC:L with VI:N and VA:N, meaning only limited confidentiality exposure (e.g. reading employee data from /api/employees) and no integrity or availability loss. That is why the aggregate base score is only 5.5 (Medium). The E:P temporal flag and the 'POC publicly available' intelligence confirm exploit code exists, but this is NOT the same as active exploitation: the CVE is NOT on CISA KEV, so the correct status is 'publicly available exploit code exists,' not in-the-wild use. EPSS is 0.77% (54th percentile), which is unremarkable and consistent with a niche, low-impact target rather than a mass-exploited one. The signals are internally consistent (low impact + low EPSS + POC but no KEV all point the same way); the main caveat is that this is a rolling-release GitHub project with NO fixed/affected version numbers and NO vendor response, so there is no patched build to upgrade to. Reported solely by VulDB (cna@vuldb.com) with no independent vendor advisory. Net: real but low priority - patch-by-code-pull or decommission rather than emergency response.

A remote, unauthenticated attacker sends a direct HTTP request to the /api/employees endpoint of an internet-exposed Stock-Management-System instance and receives employee records back because the endpoint performs no authentication check (CWE-287). Public exploit/writeup code is available (the referenced GitHub access_control_vulnerability.md), lowering the skill barrier. Because AV:N/PR:N/UI:N, no credentials, phishing, or victim interaction are needed, but the payoff is limited to disclosure of the data that endpoint returns (VC:L, no write or denial-of-service capability).