CVE-2025-4560

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings, and uploading files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-456079.8An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.CVE-2025-456087.5Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information viCVE-2025-456097.5Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a craftCVE-2025-45618.8The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute webCVE-2025-456107.5Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information vCVE-2025-456119.8Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET requesCVE-2025-456129.8Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.CVE-2025-456137.5Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payCVE-2025-456147.5Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payloCVE-2025-456159.8Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted requeCVE-2025-456169.8Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.CVE-2025-456177.5Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via
CVE-2025-4560: Medium severity, CVSS 6.5 | Vulnix