PT-2025-16589 · Unknown · Misstt123 Oasys

Moyu666 · Published 2025-04-16 · Updated 2025-06-25 · CVE-2025-3687

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions misstt123 oasys version 1.0

Description A vulnerability has been found in the Sticky Notes Handler component, leading to cross-site request forgery. The attack may be launched remotely. The issue affects some unknown functionality of the component.

Recommendations For misstt123 oasys version 1.0, consider disabling the Sticky Notes Handler component until a fix is available. As a temporary workaround, restrict access to the component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2025-3687

Affected Products

Misstt123 Oasys

References · 10

• 🔥 https://github.com/misstt123/oasys/issues/11 · Exploit
• https://osv.dev/vulnerability/CVE-2025-3687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3687 · Security Note
• https://vuldb.com/?ctiid.304976 · Note
• https://t.me/cvenotify/126673 · Telegram Post
• https://twitter.com/CVEnew/status/1912483204751142953 · Twitter Post
• https://vuldb.com/?id.304976 · Note
• https://twitter.com/VulmonFeeds/status/1912498152524939466 · Twitter Post
• https://t.me/cvetracker/21752 · Telegram Post
• https://vuldb.com/?submit.553429 · Note