PT-2025-17332 · Unknown · Volmarg Personal Management System

Abbisqq · Published 2025-04-18 · Updated 2025-04-18 · CVE-2025-28355

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System version 1.4.65

Description The issue allows attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none. This is related to Cross Site Request Forgery (CSRF).

Recommendations For Volmarg Personal Management System version 1.4.65, consider updating the SameSite cookie attribute to a more secure value, such as Lax or Strict, to mitigate the risk of CSRF attacks. As a temporary workaround, restrict access to sensitive information and functions that can be executed through CSRF attacks until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-28355

Affected Products

Volmarg Personal Management System

References · 8

• 🔥 https://github.com/abbisQQ/CVE-2025-28355/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28355 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28355 · Vendor Advisory
• https://github.com/Volmarg/personal-management-system · Note
• https://github.com/Volmarg/personal-management-system/issues/149 · Note
• https://twitter.com/CVEnew/status/1913312997923250442 · Twitter Post
• https://t.me/cvedetector/23351 · Telegram Post
• https://t.me/cvetracker/21952 · Telegram Post