CVE-2025-1575 MEDIUM

CVE-2025-1575: Harpia DiagSystem atualatendimento_jpeg.php resource injection

Vendor Harpia
Product DiagSystem
Weakness CWE-99
Published February 23, 2025
Last update February 24, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

February 23, 2025 CVE published
February 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12270 LearnHouse Student Assignment Submission sub_file resource injection CVE-2025-0756 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') CVE-2025-9263 Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection CVE-2025-0625 CampCodes School Management Software Attachment resource injection CVE-2026-13493 AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection