CVE-2025-45156

MediumCVSS 5.3

Published: 18/07/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Splashin iOS app version 2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.

Risk Assessment

Free-tier users can send location updates at any frequency, potentially causing excessive server load, increased operational costs, and violation of service terms.

Recommendation

Implement server-side validation of location update intervals for all users, especially free-tier, and consider introducing rate limiting.

Original NVD description (English source)

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.