Portfolio Management System MCA EUVD-2026-25895

Exploitation requires a valid authenticated session in the application (PR:L per CVSS vector) - unauthenticated exploitation is not supported by available data. The vulnerable endpoint update_passwd_process.php must be reachable over the network (AV:N). The attacker must supply or enumerate a valid target user's temp_user identifier; SSVC flags this as 'not automatable,' indicating that blind brute-force is insufficient and some degree of reconnaissance or enumeration of valid user identifiers is needed. The flaw is limited to integrity impact - specifically the ability to change another user's password - with no confirmed confidentiality or availability consequence. The vulnerability is constrained to installations of 1000 Projects Portfolio Management System MCA 1.0 and does not affect other products or platforms.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, reflecting that authentication is required (PR:L) and impact is limited to low integrity modification (VI:L) with no confidentiality or availability impact. EPSS at 0.03% (7th percentile) corroborates a very low probability of active exploitation despite the public POC. SSVC confirms: exploitation exists at POC level, it is not automatable (likely due to needing to enumerate valid user identifiers), and technical impact is only partial. No KEV listing confirms no confirmed widespread exploitation. The combination of required authentication, niche product deployment, and constrained scope makes this a low-priority finding for most organizations. The public POC slightly elevates opportunistic risk for unpatched instances, but the manual nature of exploitation limits mass attack viability. No data conflicts are present - all signals align consistently around low real-world risk.

An attacker with a valid authenticated session sends a crafted HTTP POST request to update_passwd_process.php, substituting the temp_user parameter value with another user's account identifier rather than their own. The application processes the password change without verifying ownership, resetting the victim's password to an attacker-controlled value and enabling account takeover. A public POC demonstrating this technique is available at https://github.com/9str0IL/CVE/issues/4.