CVE-2025-14696

MediumCVSS 5.3

Published: 15/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3 affects an unknown functionality in the file /api/GylOperator/UpdatePasswordBatch, leading to weak password recovery. The attack may be initiated remotely. The exploit is publicly available. The vendor was contacted but did not respond.

Risk Assessment

Risk of user account takeover through weak password recovery mechanisms.

Recommendation

Apply patches or restrict access to the API. Strengthen password recovery mechanisms.

Other vulnerabilities in Sixun Shanghui Group Business Management System

CVE-2025-14697Low
In Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3, unknown functionality in /ExportFiles/ allows access to files or directories. The attack can be launched remotely but has high complexity. The exploit is publicly available.

Original NVD description (English source)

A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this vulnerability is an unknown functionality of the file /api/GylOperator/UpdatePasswordBatch. The manipulation leads to weak password recovery. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS