CVE-2025-12924: falha de média gravidade em rymcu forest
rymcu forest BankController.java GlobalResult authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
rymcu · forestCVEs relacionadas — rymcu forest
No mesmo produto, das mais perigosas para as menos.
CVE-2025-12925MEDIUMrymcu forest UserDicController.java deleteDic authorizationEPSS 0.5%CVE-2026-2947MEDIUMrymcu forest User Profile UserInfoController.java updateUserInfo cross site scriptingEPSS 0.3%CVE-2026-2946MEDIUMrymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scriptingEPSS 0.3%