PT-2025-16145 · Unknown · Oz Forensics

Published 2025-04-11 · Updated 2025-04-13 · CVE-2025-32367

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Oz Forensics face recognition application versions prior to 4.0.8

Description: The issue allows PII retrieval via /statistic/list Insecure Direct Object Reference.

Recommendations: For versions prior to 4.0.8, consider disabling access to the /statistic/list endpoint until a patch is available. As a temporary workaround, restrict the use of the Insecure Direct Object Reference functionality to minimize the risk of exploitation. Avoid using the vulnerable endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-32367

Affected Products

Oz Forensics

References · 9

• 🔥 https://medium.com/@antonsimonyan7/idor-in-oz-forensics-face-recognition-application-cve-2025-32367-53684ee312ea · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32367 · Security Note
• https://twitter.com/CveFindCom/status/1910740366875128196 · Twitter Post
• https://t.me/cvedetector/22765 · Telegram Post
• https://t.me/cvetracker/21453 · Telegram Post
• https://ozforensics.com · Note
• https://t.me/cvenotify/118930 · Telegram Post
• https://twitter.com/CVEnew/status/1910773228710375741 · Twitter Post
• https://twitter.com/cybercronai/status/1911249310353666083 · Twitter Post