CVE-2025-32367CWE-425

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference

High · published April 11, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2025-04-11T00:00Z
EPSS history
Timeline
  • 11 APR 00:00Z
    The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference
    cvelistv5