CVE-2025-10390

MEDIUM

crmeb < 5.6.1 - Improper Authorization via UserAddressServices editAddress Function

Title source: llm
STIX 2.1

Description

A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Executing manipulation of the argument ID can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.323825
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.323825
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.644578

Scores

CVSS v3 5.4
EPSS 0.0034
EPSS Percentile 25.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (1)
crmeb/crmeb < 5.6.1
Published Sep 14, 2025
Tracked Since Feb 18, 2026