PT-2025-49144 · Unknown · Kalmia Cms

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-65899

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0

Description The application exhibits a user enumeration issue in its authentication process. Different error messages are returned depending on whether a user exists or not, or if the password is incorrect. Specifically, the application returns distinct responses for invalid users (user not found) versus valid users with incorrect credentials (invalid password). This allows attackers to identify valid usernames without authentication.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-65899

Affected Products

Kalmia Cms

References · 6

• 🔥 https://github.com/Noxurge/CVE-2025-65899/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65899 · Security Note
• https://github.com/DifuseHQ/Kalmia · Note
• https://twitter.com/CVEnew/status/1996694561582891455 · Twitter Post
• https://t.me/CVEtracker/38872 · Telegram Post