CVE-2025-40650 HIGH

CVE-2025-40650: Insecure Direct Object Reference (IDOR) in Clickedu

Vendor Clickedu

Product Clickedu

Weakness CWE-639 · IDOR

Published May 26, 2025

Last update May 27, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.

Key dates

02Disclosure timeline

May 26, 2025 CVE published

May 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40650 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2024-13429 WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion CVE-2025-9114 Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change CVE-2021-24473 User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR CVE-2020-8154 CVE-2025-15001 FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover