CVEvulnerability

CVE-2025-57130

8.8 HIGH Published 2025-11-05 Modified 2026-07-05 Official page ↗
Status
Modified
Published
2025-11-05
Last modified
2026-07-05
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284

Description

An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators.

Affected configurations

• zwiicms zwiicms (<= 13.6.07)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References