CVE-2025-11022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11022", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-09-26T07:33:18.673Z", "datePublished": "2025-12-09T12:36:01.669Z", "dateUpdated": "2026-06-05T06:22:55.674Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T06:22:55.674Z"}, "title": "CSRF in Panilux", "datePublic": "2025-12-09T11:41:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"vendor": "Personal Project", "product": "Panilux", "versions": [{"status": "affected", "version": "0", "lessThan": "v.0.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.\u00a0\n\nThis \n\nCSRF vulnerability resulting in Command Injection has been identified.\n\n\n\n\n\nThis issue affects Panilux: before v.0.10.0.\u00a0NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.&nbsp;\n\nThis \n\nCSRF vulnerability resulting in Command Injection has been identified.\n\n\n\n<p>This issue affects Panilux: before v.0.10.0.&nbsp;NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.</p>"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0433", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0433", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Ahmet \u00dcmit BAYRAM", "type": "finder"}], "source": {"defect": ["TR-25-0433"], "advisory": "TR-25-0433", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T14:47:36.767050Z", "id": "CVE-2025-11022", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:51:32.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T14:47:36.767050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:51:12.640Z"}}], "cna": {"title": "CSRF in Panilux", "source": {"defect": ["TR-25-0433"], "advisory": "TR-25-0433", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ahmet \u00dcmit BAYRAM"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Personal Project", "product": "Panilux", "versions": [{"status": "affected", "version": "0", "lessThan": "v.0.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-12-09T11:41:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0433", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0433", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.\u00a0\n\nThis \n\nCSRF vulnerability resulting in Command Injection has been identified.\n\n\n\n\n\nThis issue affects Panilux: before v.0.10.0.\u00a0NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.&nbsp;\n\nThis \n\nCSRF vulnerability resulting in Command Injection has been identified.\n\n\n\n<p>This issue affects Panilux: before v.0.10.0.&nbsp;NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T06:22:55.674Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11022", "state": "PUBLISHED", "dateUpdated": "2026-06-05T06:22:55.674Z", "dateReserved": "2025-09-26T07:33:18.673Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-12-09T12:36:01.669Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Panilux", "vendor": "Personal Project", "versions": [{"lessThan": "v.0.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.\u00a0\n\nThis \n\nCSRF vulnerability resulting in Command Injection has been identified.\n\n\n\n\n\nThis issue affects Panilux: before v.0.10.0.\u00a0NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en el Proyecto Personal Panilux permite la falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Esta vulnerabilidad CSRF que resulta en inyecci\u00f3n de comandos ha sido identificada. Este problema afecta a Panilux: anterior a la v.0.10.0. NOTA: Se contact\u00f3 al proveedor y respondi\u00f3 que niegan la propiedad del producto mencionado."}], "id": "CVE-2025-11022", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11022", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T14:47:36.767050Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:33.537", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0433"}, {"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-25-0433"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{}