What’s Vulnerable › Vulnerabilities
CVE-2025-64063
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-25 · updated 2026-06-17
- Weakness: CWE-285
Description
Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.
Affected products
References
- https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64063.md
- https://www.primakon.com/rjesenja/primakon-pcm/
Get alerted when CVE-2025-64063 or the next vulnerability affects your stack