What’s Vulnerable › Vulnerabilities

CVE-2025-41010: Cross-origin resource sharing (CORS) in Hiberus Sintra

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-02 · updated 2026-10-12
• Weakness: CWE-942

Description

Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol between a browser and a server to see if the request is allowed. An attacker can exploit this and potentially perform privileged actions and access confidential information when Access-Control-Allow-Credentials is enabled.

Affected products

• Hiberus Sintra: all versions

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/cross-origin-resource-sharing-cors-hiberus-sintra

Get alerted when CVE-2025-41010 or the next vulnerability affects your stack