VDB
CVE-2025-3967
CVE-2025-3967
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the component Article Handler. The manipulation of the argument articleId leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
EPSS 0.49% · 41.6th percentile
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score
0.49%
41.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| itwanger | paicoding | 1.0.3, 1.0.3 |
Timeline
- Apr 27, 2025 EPSS Score
- Apr 27, 2025 CVE Published
- Apr 27, 2025 PoC Published
- Apr 27, 2025 PoC Published
- Apr 28, 2025 CVE Updated
- May 10, 2025 EPSS Score
- May 23, 2025 EPSS Score
- May 24, 2025 Coalition ESS Score
- Jun 5, 2025 EPSS Score
- Jun 17, 2025 EPSS Score
- Jun 30, 2025 EPSS Score
- Jul 13, 2025 EPSS Score
References
- https://github.com/uglory-gll/javasec/blob/main/paicoding.md exploit
- VDB-306303 | itwanger paicoding Article post improper authorization vdb
- VDB-306303 | CTI Indicators (IOB, IOC, TTP, IOA) url
- Submit #557251 | itwanger paicoding 1.0.3 Logical loopholes 2 third-party-advisory
- https://github.com/uglory-gll/javasec/blob/main/paicoding.md#22articleapipost-horizontal-overstepping-of-authority exploit
- https://nvd.nist.gov/vuln/detail/CVE-2025-3967 advisory