CVE-2025-1108

HIGH

Janto < r12 - Unauthenticated Email Content Modification via Xml Parameter Injection

Title source: llm
STIX 2.1

Description

Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint.

References (1)

Core 1

Scores

CVSS v3 8.6
EPSS 0.0019
EPSS Percentile 9.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-345
Status published
Products (1)
Impronta/Janto < r12
Published Feb 07, 2025
Tracked Since Feb 18, 2026