CVE-2025-6865

DaiCuo index cross-site request forgery

State: Published
Severity: 5.3 Medium
Published: Jun 29, 2025
Updated: Jun 30, 2025
Reserved: Jun 28, 2025

Description

A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13. This affects an unknown part of the file /admin.php/addon/index. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-352 Cross-Site Request Forgery
CWE-862 Missing Authorization

Affected Products

Product	Versions
DaiCuon/a	1.3.0Affected 1.3.1Affected 1.3.2Affected 1.3.3Affected 1.3.4Affected 1.3.5Affected 1.3.6Affected 1.3.7Affected 1.3.8Affected 1.3.9Affected 1.3.10Affected 1.3.11Affected 1.3.12Affected 1.3.13Affected

References

VDB-314337 | DaiCuo index cross-site request forgeryvdb-entry
VDB-314337 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #603563 | daicuocms https://github.com/daicuo/cms V1.3.13 CSRFthird-party-advisory
https://github.com/wwm1995/weiming_wang/blob/main/daicuocms_1.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.