CVE-2025-63248
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires.
Risk Assessment
An authenticated user can delete questionnaires belonging to others, violating data integrity and confidentiality. May lead to data loss or sabotage.
Recommendation
Update DWSurvey to a patched version or enforce server-side authorization checks on resources. Restrict questionnaire deletion to owners.
Other vulnerabilities in DWSurvey
See all- CVE-2026-75325Critical
DWSurvey v6.14.0 is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
- CVE-2026-18723Medium
A vulnerability in DWSurvey up to 6.14.0 affects an unknown function in the file /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler component. This manipulation causes improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-18722Medium
A vulnerability was found in DWSurvey up to version 6.14.0 in the function DwDeisgnSurveyController.devSurvey in the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. Manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been made public.
Original NVD description (English source)
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS