CVE-2025-8887CWE-200CWE-639CWE-862broken-access-controlinformation-disclosure

CVE-2025-8887

Medium · published October 10, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation.

This issue affects Aybs Interaktif: from 2024 through 28082025.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2025-10-10T18:15Z
References (2)
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0329 · [email protected]https://www.usom.gov.tr/bildirim/tr-25-0329 · [email protected]
EPSS history
Timeline
  • 10 OCT 13:56Z
    IDOR in Usta Information Systems' Aybs Interaktif
    cvelistv5