by Kastro
Paper/Archive/CVE-2025-57266

CVE-2025-57266

mitre — An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attacker…

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.4.314 × 206.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the /api/assistant/list endpoint.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/LiuYuYang01/ThriveX-Server/issues/55refgist.github.com/candyb0x/fccc49a989473b7f1e47479619eaf1ca