CVE-2025-51628
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An IDOR vulnerability in the PdfHandler component of Agenzia Impresa Eccobook version 2.81.1 and below allows unauthenticated attackers to read confidential documents by manipulating the DocumentoId parameter.
Risk Assessment
The risk involves unauthorized access to sensitive documents, potentially leading to leakage of customer data or business information.
Recommendation
Immediately update to the latest software version and implement authorization checks for the DocumentoId parameter.
Other vulnerabilities in Agenzia Impresa Eccobook
See all- CVE-2025-51629High
A cross-site scripting (XSS) vulnerability was found in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1. Attackers can inject malicious JavaScript or HTML via the Temp parameter.
- CVE-2025-51627Medium
Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Administrator.
Original NVD description (English source)
Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter.