CVE-2025-7114: falha de média gravidade em SimStudioAI sim
SimStudioAI sim Session route.ts POST missing authentication
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.6%
A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Handler. The manipulation of the argument Request leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
SimStudioAI · simCVEs relacionadas — SimStudioAI sim
No mesmo produto, das mais perigosas para as menos.
CVE-2025-7107MEDIUMSimStudioAI sim route.ts handleLocalFile path traversalEPSS 0.9%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2025-9801MEDIUMSimStudioAI sim path traversalEPSS 0.8%CVE-2026-3431CRITICALSim Studio AI - MongoDB SSRF and Arbitrary Document DeletionEPSS 0.4%CVE-2026-3432CRITICALSim Studio AI - Unauthenticated OAuth Token TheftEPSS 0.3%CVE-2025-9800MEDIUMSimStudioAI sim HTML File route.ts import unrestricted uploadEPSS 0.3%