CVE-2025-2639

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of the component Article Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
n/a	JIZHICMS	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7

References

https://github.com/H3rmesk1t/vulnerability-paper/blob/main/jizhiCMS-1.7.0-Incorrect%20Access%20Control3.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.300640Permissions Required, VDB Entry
https://vuldb.com/?id.300640Permissions Required, VDB Entry
https://vuldb.com/?submit.519634Third Party Advisory, VDB Entry
https://github.com/H3rmesk1t/vulnerability-paper/blob/main/jizhiCMS-1.7.0-Incorrect%20Access%20Control3.mdExploit, Third Party Advisory

Timeline

Published: Mar 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-263909.8A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vu CVE-2025-263915.4SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-cre CVE-2025-263924.6SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account CVE-2025-263935.4SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, l CVE-2025-263944.8SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attack CVE-2025-263954.3SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL.CVE-2025-263967.8The SolarWinds Dameware Mini Remote Control was determined to be affected by Incorrect Permissions Local Privilege Escalation Vulnerability.CVE-2025-263977.8SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attack CVE-2025-263986.4SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to CVE-2025-263999.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability tha CVE-2025-26409.8A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown CVE-2025-264006.5SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information