EUVD-2025-17097Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSRF payload
-
DeliveryDeliver via phishing link
-
ExploitUser clicks while authenticated
-
ExecutionForged request executes
-
ImpactUnauthorized action performed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated user to interact with a malicious link or page while logged into the Traffic Offense Reporting System. No special configuration needed beyond default deployment. |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact and requiring user interaction. EPSS score is 0.06% (19th percentile), suggesting low exploitation probability. No KEV listing. Public exploit exists but no active exploitation confirmed. Overall risk is low. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or form that, when clicked by an authenticated admin, changes a password or modifies a traffic ticket. The exploit is publicly available, making it easy to replicate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site request forgery in code-projects Traffic Offense Reporting System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. Publicly available exploit code exists, but no active exploitation has been confirmed. The low EPSS score (0.06%) suggests limited real-world risk.
Earlier versions of this analysis (1)
RemediationAI
No official patch is available from the vendor. As a workaround, implement CSRF tokens in all state-changing requests, validate the Origin or Referer header, and enforce same-site cookie attributes. Note that these mitigations require code-level changes and may not be feasible without vendor support.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Cross-Site Request Forgery (CSRF) (CWE-352) in the Traffic Offense Reporting System, a PHP-based web application. CSRF attacks exploit the trust a web application has in an authenticated user's browser, allowing an attacker to forge requests that execute unintended actions. The affected product is identified by CPE cpe:2.3:a:carmelo:traffic_offense_reporting_system:1.0:*:*:*:*:*:*:*.
Know when Traffic Offense Reporting System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires user interaction (UI:R), low integrity impact (I:L), no confidentiality or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-5732 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. T
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to in
Exploit-DB