PT-2025-52455 · Turms · Turms

Xzzz111 · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-66906

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Turms versions through 0.10.0-SNAPSHOT

Description A Cross Site Request Forgery (CSRF) issue exists in the Turms Admin API. Successful exploitation could allow attackers to gain escalated privileges. The API endpoints and vulnerable parameters are not specified. The function names are not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-66906

Affected Products

Turms

References · 5

• 🔥 https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66906_report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66906 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66906 · Vendor Advisory
• https://github.com/turms-im/turms · Note
• https://twitter.com/CVEnew/status/2002099208787275834 · Twitter Post