CVE-2025-49187

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491887.5The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.CVE-2025-491896.1The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, s CVE-2025-49198.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was CVE-2025-491905.8The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports CVE-2025-491916.1Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, CVE-2025-491926.1The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user CVE-2025-491936.1The application fails to implement several security headers. These headers help increase the overall security level of the web application b CVE-2025-491947.5The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to inte CVE-2025-491959.8The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potential CVE-2025-491969.1A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in u CVE-2025-491977.5The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user accou CVE-2025-491987.5The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by c