14 matches found
CVE-2025-65900
CVE-2025-65900: Kalmia CMS v0.2.0 - 不適切なアクセス制御 Incorrect Access Control に対して脆弱です 脆弱性の概要 CVE ID: CVE-2025-65900 製品: DifuseHQ Kalmia CMS 影響を受けるバージョン: 0.2.0 脆弱性の種類: 不適切なアクセス制御 Incorrect Access Control 必要な権限: 低 読み取り専用ユーザーアカウント 影響 この脆弱性により、低権限ユーザーが Blowfish...
CVE-2025-65899
CVE-2025-65899: Kalmia CMS v0.2.0 - 관찰 가능한 응답 불일치에 취약함 취약점 개요 CVE ID: CVE-2025-65899 제품: DifuseHQ Kalmia CMS 영향받는 버전: 0.2.0 취약점 유형: 관찰 가능한 응답 불일치 필요 권한: 없음 영향 인증되지 않은 공격자가 유효한 사용자 이름을 열거할 수 있게 하여, 표적 암호 스프레이 공격, 자격 증명 스터핑, 계정 발견 공격을 가능하게 합니다. 수정된 버전 유지보수자 승인 대기 중 -...
📄 Kalmia CMS 0.2.0 User Enumeration
Proof of concept exploit that demonstrates a user enumeration vulnerability via the JWT authentication API on Kalmia CMS version 0.2.0. ============================================================================================================================================= | Title : Kalmia CM...
EUVD-2025-201310
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
PT-2025-49145
Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...
CVE-2025-65900
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...
CVE-2025-65899
Kalmia CMS v0.2.0 is affected by an authentication flaw described as an Observable Response Discrepancy. The login endpoint /kal-api/auth/jwt/create reveals existence of accounts by returning distinct messages: user_not_found for invalid usernames and invalid_password for valid usernames with a w...
CVE-2025-65900
Kalmia CMS 0.2.0 is affected by CVE-2025-65900 via the /kal-api/auth/users endpoint. The root cause is insufficient permission validation and excessive data exposure, enabling an authenticated user with basic read permissions to retrieve sensitive information for all platform users. A public PoC ...
