August 1, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-48046NVD

Vulnerability Summary

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
Severity Level
MEDIUM(5.3)
Published Date
May 29, 2025
Last Modified
Sep 5, 2025
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-256: Unknown/Unlisted Weakness ↗
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
CVSS v4.0 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone

External References