CVE-2025-22963

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
SismicsTeedy<= 1.11

References

Timeline

Published
Jan 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-229648.1DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inpCVE-2025-229689.8An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictionsCVE-2025-22977.8Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes iCVE-2025-229737.5An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/applicationCVE-2025-229749.8SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter iCVE-2025-229767.1SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly CVE-2025-229789.8eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.CVE-2025-22988.4An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access tCVE-2025-229806.7A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan formCVE-2025-229837.5An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive iCVE-2025-229847.5An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access senCVE-2025-22996.1The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10.
CVE-2025-22963: High severity, CVSS 7.5 | Vulnix