14 matches found
CVE-2025-65900
CVE-2025-65900: Kalmia CMS v0.2.0 - 存在访问控制不当漏洞 漏洞概述 CVE ID: CVE-2025-65900 产品: DifuseHQ Kalmia CMS 受影响版本: 0.2.0 漏洞类型: 访问控制不当 所需权限: 低（只读用户账户） 影响 该漏洞允许低权限用户获取所有平台账户的敏感信息，包括 Blowfish 密码哈希。攻击者可进行离线破解、提升权限，并可能危及管理员账户，导致系统完全控制。 修复版本 等待维护者批准 - https://github.com/DifuseHQ/Kalmia/pull/34 描述 DifuseHQ Kalmi...
CVE-2025-65899
CVE-2025-65899：Kalmia CMS v0.2.0 - 存在可观察响应差异漏洞 漏洞概述 CVE ID： CVE-2025-65899 产品： DifuseHQ Kalmia CMS 受影响版本： 0.2.0 漏洞类型： 可观察响应差异 所需权限： 无 影响 允许未经身份验证的攻击者枚举有效用户名，从而实施有针对性的密码喷洒、凭证填充和账户发现攻击。 修复版本 待维护者审批 - https://github.com/DifuseHQ/Kalmia/pull/34 描述 Kalmia CMS 0.2.0...
📄 Kalmia CMS 0.2.0 User Enumeration
Proof of concept exploit that demonstrates a user enumeration vulnerability via the JWT authentication API on Kalmia CMS version 0.2.0. ============================================================================================================================================= | Title : Kalmia CM...
EUVD-2025-201310
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
PT-2025-49145
Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65899
Kalmia CMS v0.2.0 is affected by an authentication flaw described as an Observable Response Discrepancy. The login endpoint /kal-api/auth/jwt/create reveals existence of accounts by returning distinct messages: user_not_found for invalid usernames and invalid_password for valid usernames with a w...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65900
Kalmia CMS 0.2.0 is affected by CVE-2025-65900 via the /kal-api/auth/users endpoint. The root cause is insufficient permission validation and excessive data exposure, enabling an authenticated user with basic read permissions to retrieve sensitive information for all platform users. A public PoC ...
