CVE Watchtower


← Back to CVE List

CVE-2018-25387NVD

Vulnerability Summary

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
Severity Level
MEDIUM(5.3)
Published Date
May 29, 2026
Last Modified
Jun 2, 2026
Exploitation Status
????
EPSS Score (30-Day)
0.02%Probability
Root Weakness (CWE)
N/A
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone