CVE-2025-7326

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-1390

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-73278.8The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the CVE-2025-73289.8Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks o CVE-2025-73294.8A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify CVE-2025-73306.5A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on th CVE-2025-73376.5An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that CVE-2025-73387.5Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior CVE-2025-73393.4on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in resp CVE-2025-73409.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file CVE-2025-73419.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file CVE-2025-73427.5A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process CVE-2025-73439.8The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands t CVE-2025-73448.8The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their pr