PT-2026-1183 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Publicado 2026-01-03 · Atualizado 2026-02-03 · CVE-2025-3660

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description An access control issue exists in the Petlibro Smart Pet Feeder Platform that allows authorized users to view data belonging to other users. This occurs because of a lack of proper ownership verification. An attacker can send requests to the /member/pet/detailV2 API endpoint with arbitrary pet IDs to obtain sensitive information, including pet details, member IDs, and avatar URLs, without authorization. The pet ID variable is used in the request to access the data.

Recommendations Versions prior to 1.7.31 should be updated.

Correção

Enumeração de Fraquezas

CWE-612

Identificadores relacionados

CVE-2025-3660

Produtos afetados

Petlibro Smart Pet Feeder Platform

Referências · 8

• https://t.me/cveNotify/147649 · Publicação no Telegram
• https://t.me/CVEtracker/41324 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-3660 · Nota de Segurança
• https://t.me/cveNotify/150774 · Publicação no Telegram
• https://bobdahacker.com/blog/petlibro · Nota
• https://osv.dev/vulnerability/CVE-2025-3660 · Aviso do Fabricante
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-broken-access-control-via-api-endpoint · Nota
• https://twitter.com/CVEnew/status/2007600720657203534 · Publicação no Twitter