Skip to main content

Sim CVE-2025-7114

| EUVDEUVD-2025-20195 MEDIUM
Improper Authentication (CWE-287)
2025-07-07 cna@vuldb.com
Authentication Bypass Sim
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Severity Changed
Apr 29, 2026 - 01:11 NVD
HIGH MEDIUM
CVSS changed
Apr 29, 2026 - 01:11 NVD
7.3 (HIGH) 5.5 (MEDIUM)
EUVD ID Assigned
Mar 16, 2026 - 03:37 euvd
EUVD-2025-20195
Analysis Generated
Mar 16, 2026 - 03:37 vuln.today
PoC Detected
Nov 14, 2025 - 13:46 vuln.today
Public exploit code
CVE Published
Jul 07, 2025 - 06:15 cve.org
MEDIUM 5.5
CVE Published
Jul 07, 2025 - 06:15 nvd
HIGH 7.3

DescriptionCVE.org

A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Handler. The manipulation of the argument Request leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Missing authentication in the file upload API endpoint of SimStudioAI Sim allows remote unauthenticated attackers to upload arbitrary files. The vulnerability affects all versions up to commit 37786d371e17d35e0764e1b5cd519d873d90d97b. Public exploit code is available, though no active exploitation in the wild has been confirmed (not listed in CISA KEV).

More in Sim

View all
CVE-2026-3431 CRITICAL
9.8 Mar 02

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary

CVE-2025-15099 MEDIUM POC
5.5 Dec 26

Improper authentication in Sim's CRON secret handler allows attackers to bypass authentication on internal APIs and CRON
CVE-2025-7107 MEDIUM POC
5.3 Jul 07

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLo
CVE-2025-10097 MEDIUM POC
5.3 Sep 08

A vulnerability was identified in SimStudioAI sim up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is r
CVE-2026-3432 CRITICAL
9.1 Mar 02

SimStudio has a second authorization flaw in the OAuth token endpoint that allows privilege escalation through crafted t
CVE-2026-13510 LOW POC
2.9 Jun 28

Deployment authentication token weakness in SimStudioAI Sim up to 0.6.92 leaks a truncated SHA-256 derivative of the enc

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-7114 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy