CVE-2025-15105

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15105
A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://gist.github.com/H2u8s/40be31987e52fc81076b6bfcfbdf3cd6 Exploit Third Party Advisory
https://vuldb.com/?ctiid.338476 Permissions Required VDB Entry
https://vuldb.com/?id.338476 Third Party Advisory VDB Entry
https://vuldb.com/?submit.710256 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:maxun:maxun:*:*:*:*:*:*:*:*
History

05 Oct 2026, 19:10

Type Values Removed Values Added
Summary
  • (es) Una falla de seguridad ha sido descubierta en getmaxun maxun hasta 0.0.28. Afectada es una función desconocida del archivo /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Realizar la manipulación del argumento api_key resulta en el uso de una clave criptográfica codificada. La explotación remota del ataque es posible. El ataque se considera que tiene alta complejidad. La explotabilidad se considera difícil. El exploit ha sido liberado al público y puede ser explotado. El proveedor fue contactado tempranamente sobre esta divulgación pero no respondió de ninguna manera.
Information

Published : 2025-12-27 09:15

Updated : 2026-10-07 13:10

NVD link : CVE-2025-15105

Mitre link : CVE-2025-15105

CVE.ORG link : CVE-2025-15105

JSON object : View

Products Affected

maxun

  • maxun
CWE
CWE-320

Key Management Errors

CWE-321

Use of Hard-coded Cryptographic Key

CWE-798

Use of Hard-coded Credentials