BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-12

Assigner: TWCERT/CC

Description

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-10

EPSS Evaluated

2026-07-04

NVD

CVE-2025-12868

EUVD

EUVD-2025-41750

Affected Vendors & Products

Vendor	Product	Version / Range
cybertutor	new_site_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-603	A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Attack-Flow Graph

Executive Summary

This vulnerability in the New Site Server by CyberTutor is a Use of Client-Side Authentication flaw. It allows unauthenticated remote attackers to manipulate the frontend code of the website, which enables them to escalate their privileges and gain administrator access without proper authentication.

Impact Analysis

The impact of this vulnerability is severe because attackers can gain administrator privileges remotely without authentication. This can lead to unauthorized control over the website, including modifying content, accessing sensitive data, and potentially disrupting services or compromising the integrity and availability of the system.

Hi! I’m here to help you understand CVE-2025-12868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70