CVE-2025-8260

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

State: Published
Severity: 2.3 Low
Published: Jul 28, 2025
Updated: Apr 15, 2026
Reserved: Jul 26, 2025

Description

A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.1 Low	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	2.1 Low	AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-328 Use of Weak Hash
CWE-327 Risky Cryptographic Algorithm

Affected Products

Product	Versions
VaelsysV4Vaelsys	5.0Affected 5.1Affected 5.1.0Affected 5.2Affected 5.3Affected 5.4.0Affected 5.1.1Not affected 5.4.1Not affected

References

VDB-317848 | Vaelsys VaelsysV4 Web interface vgrid_server.php weak hashvdb-entrytechnical-description
VDB-317848 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #616922 | Vaelsys Vaelsys V4 v4.1.0 Unauthorized Access Leads to Sensitive Information Leakagethird-party-advisory
https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.mdexploit
https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.htmlpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.