PT-2025-53618 · Getmaxun · Getmaxun

28Hus · Published 2025-12-27 · Updated 2025-12-27 · CVE-2025-15106

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions getmaxun versions prior to 0.0.28

Description A weakness exists in the Authentication Endpoint component of getmaxun. Specifically, the router.get function within the server/src/routes/auth.ts file is susceptible to improper authorization due to manipulation. This issue can be exploited remotely. The exploit is publicly available. The vendor was notified of this issue but did not respond.

Recommendations Versions prior to 0.0.28 should be updated. As a temporary workaround, consider disabling the router.get function until a patch is available.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

IDOR

Weakness Enumeration

CWE-285

CWE-266

CWE-639

Related Identifiers

CVE-2025-15106

Affected Products

Getmaxun

References · 11

• 🔥 https://gist.github.com/H2u8s/1a0bdb19d5c8c8f4dc72cb49ffe9a22b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15106 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15106 · Vendor Advisory
• https://vuldb.com/?id.338477 · Note
• https://twitter.com/CVEnew/status/2004868101746426347 · Twitter Post
• https://t.me/CVEtracker/40742 · Telegram Post
• https://t.me/cveNotify/146931 · Telegram Post
• https://vuldb.com/?ctiid.338477 · Note
• https://vuldb.com/?submit.710268 · Note
• https://twitter.com/vuldb/status/2004919839328993401 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2004878726190805452 · Twitter Post