U Office Force
CVE-2025-2395
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
AnalysisAI
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-565. The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator. Affected products include: Edetw U-Office Force.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in U Office Force
View allU-Office Force by e-Excellence has an insecure deserialization vulnerability allowing unauthenticated remote code execut
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. Rated critical
The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular
e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. Rate
U-Office Force Download function has a path traversal vulnerability. Rated medium severity (CVSS 6.5), this vulnerabilit
U-Office Force Download function has a path traversal vulnerability. Rated medium severity (CVSS 6.5), this vulnerabilit
U-Office Force PrintMessage function has insufficient filtering for special characters. Rated medium severity (CVSS 6.1)
U-Office Force Bulletin function has insufficient filtering for special characters. Rated medium severity (CVSS 6.1), th
U-Office Force login function has an Open Redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability i
U-Office Force Forum function has insufficient filtering for special characters. Rated medium severity (CVSS 5.4), this
U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. Rated mediu
e-Excellence U-Office Force generates an error message in webiste service. Rated medium severity (CVSS 5.3), this vulner
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today