CVE-2025-4855: falha crítica em Schiocco Support Board
Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
Publicada em · Atualizada em
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.4%
probabilidade de exploração
0.4%top 73% das CVEs
exploração observada
nãonenhuma fonte reporta
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Schiocco · Support BoardCVEs relacionadas — Schiocco Support Board
No mesmo produto, das mais perigosas para as menos.
CVE-2025-4828CRITICALSupport Board <= 3.8.0 - Unauthenticated Arbitrary File DeletionEPSS 0.9%CVE-2025-54031HIGHWordPress Support Board <= 3.8.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2026-27395CRITICALWordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-4815HIGHSQL Injection vulnerability in Support BoardEPSS 0.2%CVE-2025-54027HIGHWordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4816MEDIUMReflected Cross Site Scripting (XSS) vulnerability in Support BoardEPSS 0.2%