Skip to main content

Platform EUVDEUVD-2025-201240

| CVE-2025-57213 HIGH
Improper Access Control (CWE-284)
2025-12-04 cve@mitre.org
Authentication Bypass Platform Fuyang Lipengjun
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 15, 2026 - 16:35 euvd
EUVD-2025-201240
Analysis Generated
Mar 15, 2026 - 16:35 vuln.today
CVE Published
Dec 04, 2025 - 16:16 nvd
HIGH 7.5

DescriptionCVE.org

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.

Analysis

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls.

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

More in Platform

View all
CVE-2026-56769 MEDIUM POC
6.3 Jun 25

Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
CVE-2023-45162 CRITICAL
9.8 Oct 13

Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated

CVE-2023-36825 CRITICAL
9.8 Jul 11

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
CVE-2020-8775 HIGH
8.9 Apr 29

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
CVE-2020-8773 HIGH
8.9 Apr 29

The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
CVE-2026-5373 HIGH
8.1 Apr 07

Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
CVE-2025-1683 HIGH
7.8 Mar 12

Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an

CVE-2025-57210 HIGH
7.5 Dec 04

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive

CVE-2025-57212 HIGH
7.5 Dec 04

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
CVE-2023-5964 HIGH
7.2 Nov 06

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
CVE-2023-45163 HIGH
7.2 Nov 06

The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
CVE-2023-45161 HIGH
7.2 Nov 06

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does n

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2025-201240 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy