CVE-2025-12623

LowCVSS 3.1/10Last modified Oct 18, 2026

Description

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-126245.4Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocCVE-2025-126264.3A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgCVE-2025-126272.4The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This alloCVE-2025-126286.3The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by bCVE-2025-126297.1The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leadiCVE-2025-126304.9The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX requCVE-2025-126314.4The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, andCVE-2025-126325.5The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1CVE-2025-126337.5The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missingCVE-2025-126344.3The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checkCVE-2025-126355.4IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-siteCVE-2025-126366.5The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The
CVE-2025-12623: Low severity, CVSS 3.1 | Vulnix