CVE-2025-59797CWE-425

CVE-2025-59797

Medium · published September 22, 2025

CVSS v3.1
5.8
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane page.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2025-09-22T17:16Z
References (2)
https://github.com/Henkel-CyberVM/CVEs/blob/main/CVE-2025-59797/README.md · [email protected]https://www.profession-fit.de · [email protected]
EPSS history
Timeline
  • 22 SEP 00:00Z
    Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management…
    cvelistv5