CVE-2025-10947CWE-285CWE-639

CVE-2025-10947

Medium · published September 25, 2025

CVSS v3.1

5.3

EPSS

Percentile

41.8

In the wild

Unconfirmed

What it is

A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument pes_cpf can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 2025.8.0 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00498 · 41.8th percentile
Weaknesses: CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2025-09-25T17:15Z

References (7)

https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main · [email protected]https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main?tab=readme-ov-file#-proofs · [email protected]https://vuldb.com/?ctiid.325817 · [email protected]https://vuldb.com/?id.325817 · [email protected]https://vuldb.com/?submit.652282 · [email protected]https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main · 134c704f-9b21-4f2e-91b3-4a467353bcc0 https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main?tab=readme-ov-file#-proofs · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

25 SEP 13:02Z
Sistemas Pleno Gestão de Locação CPF validarCpf authorization
cvelistv5