CVE-2025-25618

LOW

Unifiedtransform 2.0 - Privilege Escalation via Incorrect Access Control

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-25618. PoCs published by armaansidana2003.

AI-analyzed exploit summary This repository contains a writeup for CVE-2025-25618, detailing an Incorrect Access Control vulnerability in Unifiedtransform v2.0. The vulnerability allows teachers to modify section names and room numbers, which should be restricted to administrators.

Description

Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.

Exploits (1)

nomisec WRITEUP
by armaansidana2003 · poc
https://github.com/armaansidana2003/CVE-2025-25618

This repository contains a writeup for CVE-2025-25618, detailing an Incorrect Access Control vulnerability in Unifiedtransform v2.0. The vulnerability allows teachers to modify section names and room numbers, which should be restricted to administrators.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Unifiedtransform v2.0
Auth required
Prerequisites: Teacher account credentials
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 3.3
EPSS 0.0043
EPSS Percentile 34.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (1)
changeweb/unifiedtransform 2.0
Published Mar 17, 2025
Tracked Since Feb 18, 2026