CVE-2025-54765

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-648

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-547665.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547676.5An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.CVE-2025-547685.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547698.8An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their CVE-2025-54777.5Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-a CVE-2025-547704.9A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw CVE-2025-547714.9A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing proc CVE-2025-547775.3Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it ma CVE-2025-547785.4A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A speciall CVE-2025-54788.8Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent atta CVE-2025-547807.7The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated CVE-2025-547812.8Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0,