CVE-2025-50870

{"id": "CVE-2025-50870", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-01T18:15:53.777", "references": [{"url": "https://cwe.mitre.org/data/definitions/284.html", "source": "cve@mitre.org"}, {"url": "https://gist.github.com/b0mk35h/c4d47b5c4aacecdc8e6c4b02b40ce302", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure."}, {"lang": "es", "value": "Institute-of-Current-Students 1.0 es vulnerable a un control de acceso incorrecto en el endpoint mydetailsstudent.php. El par\u00e1metro GET de myds acepta una direcci\u00f3n de correo electr\u00f3nico como entrada y devuelve directamente la informaci\u00f3n personal del estudiante correspondiente sin validar la identidad ni los permisos del usuario solicitante. Esto permite que cualquier atacante, autenticado o no, enumere y recupere informaci\u00f3n confidencial del estudiante alterando el valor del correo electr\u00f3nico en la URL de la solicitud, lo que puede provocar la divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2025-08-04T15:06:15.833", "sourceIdentifier": "cve@mitre.org"}