CVE-2025-54766

PoC —

CVSS 3.1

5.3 medium

EPSS

8%p94

Published

Jul 29, 2025 (Jul 29, 2025)

Modified

Jun 17, 2026

Description

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

Vendors: xorux
Products: xormon
Weakness: CWE-648
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (7.6%)

In the news0 stories

No ingested article mentions this CVE yet.