PT-2025-6871 · H6Web · H6Web

Bertrand Lorente Yáñez · Published 2025-02-13 · Updated 2026-01-29 · CVE-2025-1270

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: h6web (affected versions not specified)

Description: The issue is related to an insecure direct object reference (IDOR) vulnerability. It allows an authenticated attacker to access other users' information by making a POST request and modifying the pkrelated parameter in the "/h6web/ha datos hermano.php" endpoint to refer to another user. Additionally, the first request could also allow the attacker to impersonate other users, resulting in all subsequent requests being executed with the privileges of the impersonated user.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-1270

Affected Products

H6Web

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-1270 · Security Note
• https://t.me/cvedetector/17994 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web · Note
• https://twitter.com/CVEnew/status/1890046639433228734 · Twitter Post
• https://t.me/cvenotify/111192 · Telegram Post
• https://t.me/cveNotify/150313 · Telegram Post