A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Elunez
  • Eladmin

No data.

No data.

References
Link Providers
https://vuldb.com/?ctiid.322739 cve-icon cve-icon
https://vuldb.com/?id.322739 cve-icon cve-icon
https://vuldb.com/?submit.643840 cve-icon cve-icon
https://www.cnblogs.com/aibot/p/19063332 cve-icon cve-icon
History

Sun, 07 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Elunez
Elunez eladmin
Vendors & Products Elunez
Elunez eladmin

Fri, 05 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Sep 2025 17:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.
Title elunez eladmin Email Address updateEmail updateUserEmail improper authorization
Weaknesses CWE-266
CWE-285
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-09-05T17:32:07.024Z

Updated: 2025-09-05T17:41:45.247Z

Reserved: 2025-09-05T08:59:47.039Z

Link: CVE-2025-10014

cve-icon Vulnrichment

Updated: 2025-09-05T17:40:12.915Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-05T18:15:37.450

Modified: 2025-09-08T16:25:59.157

Link: CVE-2025-10014

cve-icon Redhat

No data.