CVE-2025-10423

A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/newbee-ltd/newbee-mall/issues/101	Exploit Issue Tracking Vendor Advisory
https://github.com/newbee-ltd/newbee-mall/issues/101#issue-3380163659	Exploit Issue Tracking Vendor Advisory
https://vuldb.com/?ctiid.323857	Permissions Required VDB Entry
https://vuldb.com/?id.323857	Third Party Advisory VDB Entry
https://vuldb.com/?submit.647066	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:newbee-mall_project:newbee-mall:1.0:*:*:*:*:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en newbee-mall 1.0. Afectada es la función mallKaptcha del archivo /common/mall/kaptcha. La manipulación resulta en captcha adivinable. El ataque puede ser ejecutado remotamente. Un alto nivel de complejidad está asociado con este ataque. La explotabilidad es considerada difícil. El exploit ha sido hecho público y podría ser usado.

Information

Published : 2025-09-15 04:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-10423

Mitre link : CVE-2025-10423

CVE.ORG link : CVE-2025-10423

JSON object : View

Products Affected

newbee-mall_project

newbee-mall

CWE

CWE-287

Improper Authentication

CWE-804

Guessable CAPTCHA

{"id": "CVE-2025-10423", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10423", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-15T17:10:00.457111Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"vendor": "n/a", "product": "newbee-mall", "versions": [{"status": "affected", "version": "1.0"}]}]}], "published": "2025-09-15T04:15:48.353", "references": [{"url": "https://github.com/newbee-ltd/newbee-mall/issues/101", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cna@vuldb.com"}, {"url": "https://github.com/newbee-ltd/newbee-mall/issues/101#issue-3380163659", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.323857", "tags": ["Permissions Required", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.323857", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.647066", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en newbee-mall 1.0. Afectada es la funci\u00f3n mallKaptcha del archivo /common/mall/kaptcha. La manipulaci\u00f3n resulta en captcha adivinable. El ataque puede ser ejecutado remotamente. Un alto nivel de complejidad est\u00e1 asociado con este ataque. La explotabilidad es considerada dif\u00edcil. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:newbee-mall_project:newbee-mall:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D0A6046-1A4C-488F-B8BF-6E0A3A50E5DC"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}