CVE-2025-3709

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-370909.8A server-side request forgery vulnerability exists in HPE StoreOnce Software.CVE-2025-370919.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370929.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370939.8An authentication bypass vulnerability exists in HPE StoreOnce Software.CVE-2025-370949.1A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.CVE-2025-370959.8A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.CVE-2025-370969.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370977.5A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service CVE-2025-370987.5A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.CVE-2025-370999.8A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.CVE-2025-37109.8The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthe CVE-2025-371007.7A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A