PT-2025-34443 · Laravel+1 · Laravel+1

0Xcharb · Published 2025-08-22 · Updated 2025-08-22 · CVE-2025-55741

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: UnoPim versions 0.3.0 and earlier

Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Users lacking the necessary Delete privilege for products can bypass access controls by submitting requests to the mass-delete endpoint, enabling unauthorized product deletion. This can lead to potential data loss and business disruption.

Recommendations: Update to version 0.3.1 or later.

Exploit

Fix

LPE

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2025-55741

GHSA-8P2F-FX4Q-75CX

Affected Products

Laravel

Unopim

References · 13

• 🔥 https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55741.json · Exploit
• 🔥 https://youtube.com/watch?v=J_WV8fCXlJM · Exploit
• https://osv.dev/vulnerability/CVE-2025-55741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8p2f-fx4q-75cx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55741 · Security Note
• https://github.com/unopim/unopim/commit/f49fa630afd36ff61c146b3e5bc7a0808667ca19 · Note
• https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989 · Note
• https://github.com/unopim/unopim · Note
• https://twitter.com/CVEnew/status/1958933873510814070 · Twitter Post
• https://t.me/CVEtracker/30685 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1959003595652640888 · Twitter Post
• https://youtu.be/J_WV8fCXlJM · Note