16 matches found
CVE-2025-65900
CVE-2025-65900: Kalmia CMS v0.2.0 - 不適切なアクセス制御 Incorrect Access Control に対して脆弱です 脆弱性の概要 CVE ID: CVE-2025-65900 製品: DifuseHQ Kalmia CMS 影響を受けるバージョン: 0.2.0 脆弱性の種類: 不適切なアクセス制御 Incorrect Access Control 必要な権限: 低 読み取り専用ユーザーアカウント 影響 この脆弱性により、低権限ユーザーが Blowfish...
CVE-2025-65899
CVE-2025-65899: Kalmia CMS v0.2.0 - 観測可能なレスポンスの相違（Observable Response Discrepancy）に対して脆弱 脆弱性概要 CVE ID: CVE-2025-65899 製品: DifuseHQ Kalmia CMS 影響を受けるバージョン: 0.2.0 脆弱性タイプ: Observable Response Discrepancy（観測可能なレスポンスの相違） 必要な権限: なし 影響...
📄 Kalmia CMS 0.2.0 User Enumeration
Proof of concept exploit that demonstrates a user enumeration vulnerability via the JWT authentication API on Kalmia CMS version 0.2.0. ============================================================================================================================================= | Title : Kalmia CM...
EUVD-2025-201310
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
PT-2025-49145
Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user...
CVE-2025-65899: Observable Response Discrepancy
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900: Incorrect Authorization
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900
Kalmia CMS version 0.2.0 is vulnerable to Incorrect Access Control in the /kal-api/auth/users API endpoint. The root cause is a combination of insufficient permission validation in the middleware/auth.go file and the return of unfiltered user data via web/src/api/Requests.ts. An authenticated use...
CVE-2025-65899
Kalmia CMS version 0.2.0 is susceptible to a user enumeration vulnerability within its authentication mechanism. The flaw resides in the JWT authentication endpoint (/kal-api/auth/jwt/create), where the system returns distinct error messages based on the validity of the username: user_not_found f...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
