PT-2025-43998 · Unknown · Educare Erp

Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-60982

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Educare ERP version 1.0

Description An IDOR (Insecure Direct Object Reference) vulnerability exists that allows unauthorized access to sensitive data through manipulated object references. Affected API endpoints do not enforce proper authorization checks, enabling authenticated users to access or modify data belonging to other users by altering object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without appropriate authorization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-60982

Affected Products

Educare Erp

References · 4

• 🔥 https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60982 · Security Note
• https://twitter.com/CVEnew/status/1982867551580279084 · Twitter Post
• https://educare.school · Note