PT-2025-38757 · Ard · Ard

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-55886

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ARD (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) vulnerability exists in ARD. The flaw is located in the fe uid parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization. The affected API endpoint is /payment history.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-55886

Affected Products

Ard

References · 4

• 🔥 https://github.com/0xZeroSec/CVE-2025-55886 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55886 · Security Note
• https://twitter.com/CVEnew/status/1970184002708414526 · Twitter Post
• https://services.ard.fr · Note