PT-2025-45594 · Cybertutor · New Site Server

Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-12868

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions New Site Server (affected versions not specified)

Description New Site Server, developed by CyberTutor, is affected by a Use of Client-Side Authentication issue. This allows unauthenticated remote attackers to modify the frontend code, potentially gaining administrator privileges on the website. The modification of frontend code enables attackers to bypass authentication controls and achieve complete control over the website’s administrative functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-603

Related Identifiers

CVE-2025-12868

Affected Products

New Site Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-12868 · Security Note
• https://twitter.com/0dayPublishing/status/1987726842934001989 · Twitter Post
• https://twitter.com/CveFindCom/status/1987757531331019076 · Twitter Post
• https://twitter.com/CVEnew/status/1987729277740098011 · Twitter Post
• https://twitter.com/CveTodo/status/1987739082538013078 · Twitter Post
• https://t.me/cveNotify/142240 · Telegram Post
• https://twcert.org.tw/tw/cp-132-10493-bf807-1.html · Note
• https://twcert.org.tw/en/cp-139-10492-84a10-2.html · Note
• https://twitter.com/cracbot/status/1989287245665436058 · Twitter Post
• https://t.me/CVEtracker/36891 · Telegram Post
• https://twitter.com/offseq/status/1987739733347164469 · Twitter Post
• https://twitter.com/gothburz/status/1989408478012530799 · Twitter Post