CVE-2025-11406 MEDIUM

CVE-2025-11406: kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure

Vendor Kaifangqian
Product kaifangqian-base
Weakness CWE-200 · Info exposure
Published October 7, 2025
Last update October 7, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Key dates

Disclosure timeline

October 7, 2025 CVE published
October 7, 2025 Record updated