CVE-2025-15398

LowCVSS 3.7

Published: 31/12/2025(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

45th percentile - higher than 45% of all known CVEs

Summary

Vulnerability in Uasoft Badaso up to 2.9.7 in the forgetPassword function of the Token Handler component. Weak password recovery allows remote attack, though with high complexity.

Risk Assessment

Weak password recovery could lead to account takeover, especially if attackers know technical details.

Recommendation

Upgrade Badaso to a version newer than 2.9.7 if available, or apply mitigating measures.

Other vulnerabilities in Uasoft Badaso

CVE-2026-19376High
A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Original NVD description (English source)

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS