CVE-2025-8260lowCWE-327CWE-328

CVE-2025-8260: falha de baixa gravidade em VaelsysV4

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar VaelsysV4

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.3%
A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
Vaelsys · VaelsysV4
CVEs relacionadas — VaelsysV4

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8259MEDIUMVaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injectionEPSS 3.2%CVE-2025-8261MEDIUMVaelsys VaelsysV4 User Creation vgrid_server.php improper authorizationEPSS 0.7%