PT-2025-54686 · Maven · Org.Nutz:Nutzboot-Parent

Published 2025-12-01 · Updated 2025-12-01

OSV

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Transaction API. The manipulation of the argument from/to/wei leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Exploit

Fix

Incorrect Privilege Assignment

Incorrect Authorization

Weakness Enumeration

CWE-266

CWE-863

Related Identifiers

GHSA-53V5-9752-QQ92

Affected Products

Org.Nutz:Nutzboot-Parent

References · 8

• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13806 · Security Note
• https://osv.dev/vulnerability/GHSA-53v5-9752-qq92 · Vendor Advisory
• https://github.com/nutzam/nutzboot · Note
• https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md · Note
• https://vuldb.com/?submit.692061 · Note
• https://vuldb.com/?id.333816 · Note
• https://vuldb.com/?ctiid.333816 · Note