CVE-2025-1557

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155707.8A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a ma CVE-2025-155715.5A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file st CVE-2025-155725.5A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak CVE-2025-155739.4The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqt CVE-2025-155746.5When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the So CVE-2025-155755.3The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash mal CVE-2025-155767.5If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancest CVE-2025-155777.5An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valm CVE-2025-155789.8Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is a CVE-2025-155799.5Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to r CVE-2025-15586.5Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the CVE-2025-155814.7Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.