CVE-2025-48497

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
iroha Soft Co., Ltd.	iroha Board	versions v0.10.12 and earlier

References

https://irohaboard.irohasoft.jp/security/Third Party Advisory
https://jvn.jp/en/jp/JVN92520966/Third Party Advisory

Timeline

Published: Jun 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-484987.5A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of CVE-2025-484995.3Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (CVE-2025-48506.3A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of CVE-2025-485007.3A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker CVE-2025-485019.3An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS comman CVE-2025-485025.5Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial o CVE-2025-485037.8A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in CVE-2025-485046.8Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor CVE-2025-485051.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged e CVE-2025-485064.6Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, CVE-2025-485078.6The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors acces CVE-2025-485086.0Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control