CVE-2025-51533

MEDIUM EPSS 21.1%

Published Aug 7, 202510mo ago · Modified Jun 17, 20261w ago

5.3 CVSS 3.1

Medium

Published Aug 7, 2025 10mo ago

Last Modified Jun 17, 2026 1w ago

Description

An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.

CVSS Details

Base Score

5.3

Exploitability

3.9

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

21.1% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-639

Affected Products 1

Vendor	Product	Version	Range
sagedpw	sage_dpw	*	<2025_06_000

References 2

sec4you-pentest.com https://www.sec4you-pentest.com/schwachstelle/sage-dpw-vorhersehbare-url-ids-ermoeglichen-unautorisierten-zugriff-auf-interne-formulare/

ExploitThird Party Advisory
sec4you-pentest.com https://www.sec4you-pentest.com/schwachstellen

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.