CVE-2025-27454

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitting a web request that they did not intend. The request uses the victim's browser's saved authorization to execute the request.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274556.1The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a userCVE-2025-274569.8The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short tiCVE-2025-274577.5All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitiveCVE-2025-274587.5The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. TheCVE-2025-274597.5The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwordsCVE-2025-27469.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of emCVE-2025-274606.8The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physiCVE-2025-274616.8During startup, the device automatically logs in the EPC2 Windows user without requesting a password.CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindoCVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executabl
CVE-2025-27454: Medium severity, CVSS 4.3 | Vulnix