CVE-2025-10352CWE-862broken-access-control

CVE-2025-10352

published October 8, 2025

CVSS

9.3

EPSS

Percentile

24.6

In the wild

Unconfirmed

What it is

Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.

The record

Technical detail

CVSS: 9.3 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00327 · 24.6th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-10-08T15:15Z

References (2)

https://github.com/ivansmc00/CVE-2025-10352-POC · [email protected]https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform · [email protected]

EPSS history

Timeline

08 OCT 10:46Z
Missing Authorization vulnerability in Melis Platform
cvelistv5