CVE-2025-5521 MEDIUM

CVE-2025-5521: WuKongOpenSource WukongCRM updataPassword cross-site request forgery

Vendor Wukongopensource
Product WukongCRM
Weakness CWE-352 · CSRF
Published June 3, 2025
Last update June 3, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

June 3, 2025 CVE published
June 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-40687 WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2024-2959 SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation CVE-2024-27195 WordPress Watermark RELOADED plugin <= 1.3.5 - CSRF to XSS vulnerability CVE-2014-125028 valtech IDP Test Client main.py cross-site request forgery CVE-2024-30545 WordPress Social Author Bio plugin <= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability