What’s Vulnerable › Vulnerabilities

CVE-2025-29995: Account Takeover Vulnerability in CAP back office application

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-13 · updated 2026-06-17
• Weakness: CWE-640

Description

This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.

Affected products

• Rising Technosoft CAP back office application: before 2.0.4

References

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048

Get alerted when CVE-2025-29995 or the next vulnerability affects your stack