CVE-2025-9310

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-259 CWE-798

Affected software

Vendor	Product	Versions
yeqifu	carRental	3fabb7eae93d209426638863980301d6f99866b3

References

https://github.com/caigo8/CVE-md/blob/main/carRentalV1.0/druid%E6%9C%AA%E6%8E%88%E6%9D%83.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.320915Permissions Required, VDB Entry
https://vuldb.com/?id.320915Third Party Advisory, VDB Entry
https://vuldb.com/?submit.633588Third Party Advisory, VDB Entry
https://github.com/caigo8/CVE-md/blob/main/carRentalV1.0/druid%E6%9C%AA%E6%8E%88%E6%9D%83.mdExploit, Third Party Advisory

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93119.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-93129.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services CVE-2025-93139.3An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the data CVE-2025-93149.8The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload CVE-2025-93156.3An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attribut CVE-2025-93166.9N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.CVE-2025-93178.4The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse eng CVE-2025-93186.5The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_lin CVE-2025-93197.5A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions.CVE-2025-93219.8The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient inp CVE-2025-93227.5The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL I CVE-2025-93235.5Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dis