CVE-2025-29557

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-29566.5A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.0.8.S0_ and classified as problematic. This issue affects the function plugins_c CVE-2025-295684.8A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown feature CVE-2025-29576.5A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It has been classified as problematic. Affected is the function sub_401DB0 of the fi CVE-2025-295707.8An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_ima CVE-2025-295736.1Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.CVE-2025-29586.5A vulnerability was found in TRENDnet TEW-818DRU 1.0.14.6. It has been declared as problematic. Affected by this vulnerability is an unknown CVE-2025-29596.5A vulnerability was found in TRENDnet TEW-410APB 1.3.06b. It has been rated as problematic. Affected by this issue is the function sub_4019A CVE-2025-295925.6oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.CVE-2025-295946.1A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately valida CVE-2025-29606.5A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub CVE-2025-296026.1flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.CVE-2025-296064.3py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.