CVE-2025-9210

HighCVSS 8.1

Published: 18/08/2026(UTC)Updated: 29/09/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System before version 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs.

Risk Assessment

The risk is the possibility of authenticated users gaining higher privileges, which could lead to unauthorized data access.

Recommendation

It is recommended to update the system to version 2.22.0 or later, which includes the JWT signature validation fix.

Other vulnerabilities in Otalio Ship Property Management System

CVE-2025-9211Medium
Otalio Ship Property Management System before version 2.22.0 contains a vulnerability due to unescaped stored values in the application security page. Authenticated attackers can escalate privileges via persistent cross-site scripting (XSS).

Original NVD description (English source)

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

Vulnerability data from NVD (NIST) · CISA KEV · EPSS