GitHub Advisoryadvisory · Packagist

GHSA-p3vc-g9f9-mgw4 Melis Platform CMS Unauthenticated Admin Account Creation

CRITICAL Published 2025-10-08 Modified 2025-10-09 Official page ↗
Aliases
CVE-2025-10352
Ecosystem
Packagist
Packages
melisplatform/melis-core
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-10-09

Affected packages

• Packagist melisplatform/melis-core: < 5.3.11 → fixed in 5.3.11

Description

Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.

Related

Alias · CVE (1)

  • CVE-2025-10352 Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References