CVE-2025-8260lowCWE-327CWE-328

CVE-2025-8260: fallo de gravedad baja en VaelsysV4

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear VaelsysV4

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.3epss 0.3%
A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Vaelsys · VaelsysV4
CVEs relacionadas — VaelsysV4

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-8259MEDIUMVaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injectionEPSS 3.2%CVE-2025-8261MEDIUMVaelsys VaelsysV4 User Creation vgrid_server.php improper authorizationEPSS 0.7%