CVE-2025-10352
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the melis-core module of Melis Technology's Melis Platform allows an unauthenticated attacker to create an administrator account. Exploitation occurs via a request to the '/melis/MelisCore/ToolUser/addNewUser' endpoint.
Risk Assessment
An attacker could create an administrator account and take full control of the Melis platform, leading to complete system compromise.
Recommendation
Immediately update the Melis platform to a version containing the fix and restrict access to the addNewUser endpoint to authenticated administrators only.
Other vulnerabilities in Melis Platform
See all- CVE-2025-10353Critical
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
- CVE-2025-10351Critical
A SQL injection vulnerability in the melis-cms module of the Melis platform from Melis Technology allows an attacker to retrieve, create, update, and delete databases. The vulnerability occurs in the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
Original NVD description (English source)
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS