VDB
CVE-2025-4838
CVE-2025-4838
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function doPost of the file /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java of the component Login. The manipulation of the argument ret leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
EPSS 0.41% · 32.6th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.41%
32.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| kanwangzjm | Funiture | * |
Timeline
- May 17, 2025 CVE Published
- May 17, 2025 PoC Published
- May 18, 2025 EPSS Score
- May 18, 2025 PoC Published
- May 19, 2025 CVE Updated
- May 30, 2025 EPSS Score
- Jun 10, 2025 EPSS Score
- Jun 22, 2025 EPSS Score
- Jul 4, 2025 EPSS Score
- Jul 16, 2025 EPSS Score
- Jul 27, 2025 EPSS Score
- Aug 8, 2025 EPSS Score
References
- VDB-309306 | kanwangzjm Funiture Login LoginServlet.java doPost redirect vdb
- VDB-309306 | CTI Indicators (IOB, IOC, TTP, IOA) url
- Submit #574825 | kanwangzjm funiture master branch Open Redirect third-party-advisory
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250510-01.md exploit
- https://nvd.nist.gov/vuln/detail/CVE-2025-4838 advisory