CVE-2025-52168
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An incorrect access control vulnerability in the dynawebservice component of Agorum core open versions 11.9.2 and 11.10.1 allows unauthenticated attackers to access arbitrary files on the system.
Risk Assessment
The organization is at risk of sensitive data leakage, including configuration files, customer data, or other confidential information stored on the server. The attack requires no authentication, increasing the likelihood of exploitation.
Recommendation
Immediately update Agorum core open to a patched version. If no update is available, restrict access to the dynawebservice component to trusted networks only.
Other vulnerabilities in Agorum core open
See all- CVE-2025-52169High
A reflected cross-site scripting (XSS) vulnerability was discovered in Agorum core open versions 11.9.2 and 11.10.1. An attacker can inject a malicious script into a request, which will be executed in the victim's browser.
- CVE-2025-52163Medium
An SSRF vulnerability in the TunnelServlet component of Agorum core open v11.9.2 and v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.
- CVE-2025-52166Medium
Incorrect access control in Agorum core open versions 11.9.2 and 11.10.1 allows authenticated attackers to escalate privileges to Administrator.
- CVE-2025-52164High
Software GmbH Agorum core open versions 11.9.2 and 11.10.1 were found to store credentials in plaintext.
- CVE-2025-52162Medium
An XML External Entity (XXE) vulnerability was discovered in Agorum core open versions 11.9.2 and 11.10.1 in the RSSReader endpoint. It allows attackers to access sensitive data by providing a crafted XML input.
Original NVD description (English source)
Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS