EUVD-2025-18847Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link
-
DeliveryDeliver via email or web
-
ExploitVictim clicks while authenticated
-
ExecutionForged request executed
-
ImpactUnauthorized action performed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attack requires the victim to be authenticated to the Expense Management System and to interact with a malicious link or form (user interaction required per CVSS). No special configuration is needed; the vulnerability exists in the default deployment of version 1.0. |
| Impact | The CVSS 4.0 base score is 1.3 (Low), with a vector indicating network attack vector, low attack complexity, no privileges required, but user interaction is required. The EPSS score is 0.04% (12th percentile), indicating very low exploitation probability. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified. The SSVC decision would likely be 'Low' due to low technical impact and no exploitation. The risk is minimal, but the vulnerability could be chained with social engineering. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or form that, when clicked by an authenticated user of the Expense Management System, triggers an unintended action such as changing a password or creating a new user. The attack requires user interaction (clicking the link) and is limited by the lack of public exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site request forgery in CodeAstro Expense Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request, requiring user interaction. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a workaround, implement CSRF tokens in all state-changing requests, enforce same-site cookie attributes, and consider using custom headers to validate requests. These mitigations may require code changes and could affect usability if not implemented carefully.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Cross-Site Request Forgery (CSRF), classified under CWE-352. CSRF exploits the trust a web application has in an authenticated user's browser, allowing an attacker to forge requests that execute unintended actions. The affected product is CodeAstro Expense Management System version 1.0, as identified by the CPE string cpe:2.3:a:codeastro:expense_management_system:1.0:*:*:*:*:*:*:*.
Know when Expense Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
User interaction required, low integrity impact, no confidentiality or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6478, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Expense Management System
View allAn issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploade
Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/deb
XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store
A vulnerability was found in SourceCodester Expense Management System. Rated critical severity (CVSS 9.8), this vulnerab
A vulnerability was found in CodeAstro Expense Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerabili
Stored cross-site scripting in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated users with high pr
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated high-privilege use
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows high-privileged authenticated us
GitHub PoC
Exploit-DB