EUVD-2025-18733Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
DeliverySend crafted GET/POST to userdelete.php with target user ID
-
ExploitAuthorization bypass
-
ExecutionDelete arbitrary user account
-
ImpactImpact: loss of user accounts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have a valid low-privilege account on the Real Estate Management System. The attack is remote and requires no special configuration beyond default deployment. The vulnerability is in the userdelete.php endpoint, which is part of the User Delete Handler component. |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L, indicating low impact on integrity and availability. EPSS score is 0.13% (33rd percentile), suggesting low exploitation probability. A public exploit exists, but no CISA KEV listing or active exploitation reports. The SSVC decision would likely be 'low' priority due to low technical impact and no evidence of active exploitation. The low CVSS score contrasts with the 'critical' rating in the description, which may reflect a different scoring system or misinterpretation. |
| Exploit ScenarioDerived | An authenticated attacker with low privileges sends a crafted HTTP request to userdelete.php with a manipulated ID parameter, bypassing authorization checks to delete arbitrary user accounts. This could disrupt operations or remove administrative accounts. A public exploit is available, simplifying the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Authorization bypass in ScriptAndTools Real Estate Management System 1.0 allows remote authenticated attackers to delete arbitrary users by manipulating the ID parameter in userdelete.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.13%), indicating limited exploitation likelihood.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, restrict access to userdelete.php via web server access controls (e.g., .htaccess) to only authorized administrators, or disable the endpoint if not required. Note that this may break administrative functionality. Monitor for vendor updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an authorization bypass (CWE-285) in the User Delete Handler component of a PHP-based web application. The affected product is Real Estate Management System 1.0, identified by CPE cpe:2.3:a:scriptandtools:real_estate_management_system:1.0:*:*:*:*:*:*:*. The issue arises from improper enforcement of access controls on the userdelete.php endpoint, allowing a user with low privileges to delete other users by supplying a crafted ID parameter.
Know when Real Estate Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
PR:L due to required authentication; low integrity and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6329 rated CVSS 5.4. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. Rated high s
Critical SQL injection vulnerability in CodeAstro Real Estate Management System version 1.0, specifically in the /regist
Critical SQL injection vulnerability in CodeAstro Real Estate Management System version 1.0 affecting the /admin/index.p
Critical SQL injection vulnerability in CodeAstro Real Estate Management System version 1.0, affecting the /login.php fi
A vulnerability was found in itsourcecode Real Estate Management System 1.0. Rated medium severity (CVSS 6.9), this vuln
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as critical. This issue affe
A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affect
A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affect
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticate
A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. Rated medium severity (C
A vulnerability was found in CodeAstro Real Estate Management System 1.0. Rated medium severity (CVSS 5.4), this vulnera
A vulnerability was found in CodeAstro Real Estate Management System up to 1.0. Rated medium severity (CVSS 5.1), this v
GitHub PoC
Exploit-DB