PT-2025-53618 · Getmaxun · Getmaxun

28Hus · CVE-2025-15106 · Published 2025-12-27 · Updated 2025-12-27

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions getmaxun versions prior to 0.0.28

Description A weakness exists in the Authentication Endpoint component of getmaxun. Specifically, the router.get function within the server/src/routes/auth.ts file is susceptible to improper authorization due to manipulation. This issue can be exploited remotely. The exploit is publicly available. The vendor was notified of this issue but did not respond.

Recommendations Versions prior to 0.0.28 should be updated. As a temporary workaround, consider disabling the router.get function until a patch is available.

Exploit

Fix

IDOR

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-639

CWE-285

CWE-266

Related Identifiers

CVE-2025-15106

Affected Products

Getmaxun

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15106.json · Exploit
• 🔥 https://gist.github.com/H2u8s/1a0bdb19d5c8c8f4dc72cb49ffe9a22b · Exploit
• https://osv.dev/vulnerability/CVE-2025-15106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15106 · Security Note
• https://t.me/cveNotify/146931 · Telegram Post
• https://t.me/CVEtracker/40742 · Telegram Post
• https://vuldb.com/?submit.710268 · Note
• https://twitter.com/CVEnew/status/2004868101746426347 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2004878726190805452 · Twitter Post
• https://vuldb.com/?id.338477 · Note
• https://vuldb.com/?ctiid.338477 · Note
• https://twitter.com/vuldb/status/2004919839328993401 · Twitter Post