Is there a public PoC exploit available for CVE-2025-8260?

Yes, a public proof-of-concept exploit is available for CVE-2025-8260. Prioritise patching immediately. EPSS: 0.0%.

VaelsysV4 CVE-2025-8260

Q: What is the CVSS score of CVE-2025-8260?

CVE-2025-8260 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2025-07-28 cna@vuldb.com

PHP Information Disclosure Vaelsys

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-reachable endpoint but high complexity for hash exploitation; low privileges required; only partial confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:49 vuln.today

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.3 (LOW) 1.3 (LOW)

CVE Published

Jul 28, 2025 - 06:15 cve.org

LOW 1.3

DescriptionCVE.org

A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.

AnalysisAI

Weak cryptographic hashing (CWE-327) in VaelsysV4's PHP web interface exposes sensitive information to authenticated remote attackers who can manipulate the xajaxargs parameter of /grid/vgrid_server.php. Affected versions span the 5.1.0 and 5.4.0 release lines; patched releases 5.1.1 and 5.4.1 are available. No public exploit identified at time of analysis per CISA KEV, but a public proof-of-concept exists, and the EPSS score of 0.03% confirms very limited real-world exploitation activity to date.

Technical ContextAI

VaelsysV4 is a PHP-based video surveillance and security management platform (CPE: cpe:2.3:a:vaelsys:vaelsys:4.1.0). The affected endpoint /grid/vgrid_server.php appears to use xAjax, a legacy PHP AJAX framework that passes serialized arguments via the xajaxargs parameter. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) indicates the application applies a cryptographically weak hashing function - likely MD5 or SHA-1 - to sensitive request data or stored values processed through this endpoint. Such algorithms are vulnerable to preimage attacks, collision attacks, or rainbow-table lookups, allowing an attacker who can observe or interact with hashed outputs to reconstruct or infer the original sensitive values. The PHP tag in the intelligence metadata reinforces that the flaw is in server-side PHP logic rather than a client-side or framework-level component.

RemediationAI

Upgrade VaelsysV4 to version 5.1.1 (from the 5.1.x branch) or 5.4.1 (from the 5.4.x branch), which are the vendor-confirmed patched releases per the advisory at https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html. If immediate upgrade is not possible, restrict access to the /grid/vgrid_server.php endpoint via web server configuration (e.g., IP allowlist or require elevated authentication at the reverse proxy layer); note this may interrupt grid-related AJAX functionality for affected users. As a broader compensating control, ensure the VaelsysV4 web interface is accessible only over a VPN or private network segment, removing the network-accessible attack surface entirely at the cost of eliminating external access to the management interface.