CVE-2025-13804

MediumCVSS 4.3

Published: 01/12/2025(UTC)Updated: 26/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. An unknown function in the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the Ethereum Wallet Handler component allows manipulation, resulting in information disclosure. The attack may be initiated remotely, and the exploit has been released to the public.

Risk Assessment

Information disclosure could allow an attacker to access sensitive data, potentially leading to further attacks or confidentiality breaches.

Recommendation

It is recommended to upgrade to a version that fixes this vulnerability and restrict access to this component.

Other vulnerabilities in NutzBoot

CVE-2025-13805Low
Vulnerability in nutzam NutzBoot up to 2.6.0-SNAPSHOT, affecting the getInputStream function in nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the LiteRpc-Serializer component, leading to deserialization. The attack can be launched remotely but is difficult to exploit.

Original NVD description (English source)

A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Ethereum Wallet Handler. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS