CVE-2025-12868
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-11-12
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cybertutor | new_site_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-603 | A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the New Site Server by CyberTutor is a Use of Client-Side Authentication flaw. It allows unauthenticated remote attackers to manipulate the frontend code of the website, which enables them to escalate their privileges and gain administrator access without proper authentication.
How can this vulnerability impact me? :
The impact of this vulnerability is severe because attackers can gain administrator privileges remotely without authentication. This can lead to unauthorized control over the website, including modifying content, accessing sensitive data, and potentially disrupting services or compromising the integrity and availability of the system.