CVE-2025-8260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8260", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-07-26T16:14:24.601Z", "datePublished": "2025-07-28T06:02:05.309Z", "dateUpdated": "2026-04-15T07:02:44.090Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-15T07:02:44.090Z"}, "title": "Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-328", "lang": "en", "description": "Use of Weak Hash"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "Vaelsys", "product": "VaelsysV4", "versions": [{"version": "5.0", "status": "affected"}, {"version": "5.1", "status": "affected"}, {"version": "5.1.0", "status": "affected"}, {"version": "5.2", "status": "affected"}, {"version": "5.3", "status": "affected"}, {"version": "5.4.0", "status": "affected"}, {"version": "5.1.1", "status": "unaffected"}, {"version": "5.4.1", "status": "unaffected"}], "modules": ["Web interface"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-07-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-15T09:07:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "waiwai24 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "security_vaelsys (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/vuln/317848", "name": "VDB-317848 | Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/317848/cti", "name": "VDB-317848 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/616922", "name": "Submit #616922 | Vaelsys Vaelsys V4 v4.1.0 Unauthorized Access Leads to Sensitive Information Leakage", "tags": ["third-party-advisory"]}, {"url": "https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md", "tags": ["exploit"]}, {"url": "https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-28T15:57:53.324478Z", "id": "CVE-2025-8260", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:58:03.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8260", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-28T15:57:53.324478Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:57:59.502Z"}}], "cna": {"title": "Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash", "credits": [{"lang": "en", "type": "reporter", "value": "waiwai24 (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "security_vaelsys (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "Vaelsys", "modules": ["Web interface"], "product": "VaelsysV4", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.1"}, {"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "5.2"}, {"status": "affected", "version": "5.3"}, {"status": "affected", "version": "5.4.0"}, {"status": "unaffected", "version": "5.1.1"}, {"status": "unaffected", "version": "5.4.1"}]}], "timeline": [{"lang": "en", "time": "2025-07-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-15T09:07:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/317848", "name": "VDB-317848 | Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/317848/cti", "name": "VDB-317848 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/616922", "name": "Submit #616922 | Vaelsys Vaelsys V4 v4.1.0 Unauthorized Access Leads to Sensitive Information Leakage", "tags": ["third-party-advisory"]}, {"url": "https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md", "tags": ["exploit"]}, {"url": "https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "Use of Weak Hash"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-15T07:02:44.090Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8260", "state": "PUBLISHED", "dateUpdated": "2026-04-15T07:02:44.090Z", "dateReserved": "2025-07-26T16:14:24.601Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-07-28T06:02:05.309Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Web interface"], "product": "VaelsysV4", "vendor": "Vaelsys", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.1"}, {"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "5.2"}, {"status": "affected", "version": "5.3"}, {"status": "affected", "version": "5.4.0"}, {"status": "unaffected", "version": "5.1.1"}, {"status": "unaffected", "version": "5.4.1"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vaelsys:vaelsys:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0F5FB730-6FDF-4D07-983B-D79AA2EC4FB2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Vaelsys 4.1.0, clasificada como problem\u00e1tica. Esta vulnerabilidad afecta al c\u00f3digo desconocido del archivo /grid/vgrid_server.php del componente MD4 Hash Handler. La manipulaci\u00f3n del argumento xajaxargs da lugar al uso de un hash d\u00e9bil. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece dif\u00edcil de explotar. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, pero no respondi\u00f3."}], "id": "CVE-2025-8260", "lastModified": "2026-06-17T10:06:37.870", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8260", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-28T15:57:53.324478Z", "version": "2.0.3"}}]}, "published": "2025-07-28T06:15:25.620", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md"}, {"source": "cna@vuldb.com", "url": "https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/616922"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/317848"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/317848/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-327"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T16:20:15.849220+00:00", "value": {"mitigation_remediation": ["Upgrade the Vaelsys VaelsysV4 application to at least version\u202f5.1.1 or\u202f5.4.1, which removes the vulnerable weak hash handling.", "If an upgrade cannot occur immediately, restrict external access to the /grid/vgrid_server.php endpoint via firewall rules or IP whitelisting to limit the attack surface.", "Review any custom code that processes xajaxargs or performs hash operations and replace insecure algorithms with cryptographically secure hash functions as recommended by CWE\u2011327 guidance."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure (weak hash may expose credentials or sensitive data)"}, "threat_synthesis": {"affected_systems": "The issue affects Vaelsys VaelsysV4 versions up to 5.1.0 and 5.4.0, specifically the file /grid/vgrid_server.php in the Web interface component. Users running any of these releases should verify that they are not using the affected build and consider an upgrade to the patched releases.", "description_and_impact": "A flaw exists in Vaelsys VaelsysV4 where manipulating the xajaxargs parameter in the Web interface triggers the use of a weak hash algorithm. The weakness lies in the cryptographic handling of the argument, potentially allowing an attacker to recover hash values or infer stored secrets. This can lead to leakage of sensitive information, such as user credentials or configuration data, compromising confidentiality. The vulnerability is not a direct remote code execution flaw, but it facilitates unauthorized data disclosure through insecure hashing.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low overall severity, and the EPSS score of less than 1% shows a very small chance of exploitation in the wild. The vulnerability is listed as not included in the CISA KEV catalog. Although the exploit is publicly available, it requires remote manipulation of a specific HTTP argument and is considered high complexity and difficult to successfully exploit. Nonetheless, because sensitive data may be compromised, immediate patching is recommended over passive monitoring."}}}}, "created": "2025-07-28T15:24:22.642346+00:00", "updated": "2026-04-20T16:30:06.286153+00:00", "vendors": ["vaelsys", "vaelsys$PRODUCT$vaelsys"]}