16 matches found
CVE-2025-65900
CVE-2025-65900: Kalmia CMS v0.2.0 - is vulnerable to Incorrect Access Control Vulnerability Overview CVE ID: CVE-2025-65900 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Incorrect Access Control Privileges Required: Low Read-only user account Impact This vulnerability...
CVE-2025-65899
CVE-2025-65899: Kalmia CMS v0.2.0 - is vulnerable to Observable Response Discrepancy Vulnerability Overview CVE ID: CVE-2025-65899 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Observable Response Discrepancy Privileges Required: None Impact Allows unauthenticated...
📄 Kalmia CMS 0.2.0 User Enumeration
Proof of concept exploit that demonstrates a user enumeration vulnerability via the JWT authentication API on Kalmia CMS version 0.2.0. ============================================================================================================================================= | Title : Kalmia CM...
EUVD-2025-201310
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65899: Observable Response Discrepancy
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900: Incorrect Authorization
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 is susceptible to a user enumeration vulnerability within its authentication mechanism. The flaw resides in the JWT authentication endpoint (/kal-api/auth/jwt/create), where the system returns distinct error messages based on the validity of the username: user_not_found f...
CVE-2025-65900
Kalmia CMS version 0.2.0 is vulnerable to Incorrect Access Control in the /kal-api/auth/users API endpoint. The root cause is a combination of insufficient permission validation in the middleware/auth.go file and the return of unfiltered user data via web/src/api/Requests.ts. An authenticated use...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
PT-2025-49145
Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
