CVE-2025-52162
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability was discovered in Agorum core open versions 11.9.2 and 11.10.1 in the RSSReader endpoint. It allows attackers to access sensitive data by providing a crafted XML input.
Risk Assessment
The risk involves reading confidential files from the server, potentially leading to data leakage of passwords, keys, or system configurations.
Recommendation
Immediately update Agorum core open to the latest available version that fixes this vulnerability. Until then, restrict access to the RSSReader endpoint and validate/filter XML input.
Original NVD description (English source)
agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.