PT-2026-20459 · Mayswind · Ezbookkeeping

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-65519

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mayswind ezbookkeeping versions prior to 1.3.0

Description The application does not properly validate nesting depth when processing JSON and XML files during import. This allows attackers with valid credentials to cause a denial of service by uploading specially crafted, deeply nested files. This can lead to CPU exhaustion, service degradation, or complete service unavailability.

Recommendations Update mayswind ezbookkeeping to version 1.3.0 or later.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-65519

Affected Products

Ezbookkeeping

References · 5

• 🔥 https://github.com/ictrun/EBK-SA-2025-001 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65519 · Security Note
• https://twitter.com/VulmonFeeds/status/2024217926870425831 · Twitter Post
• https://twitter.com/CVEnew/status/2024172398547701775 · Twitter Post