Medium severity · published Jan 30, 2025
CVE-2025-0743
Improper Access Control vulnerability in EmbedAI
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EmbedAI · EmbedAI
before 2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0743
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0743
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
More from EmbedAI
6.5
CVE-2025-0745
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0744
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0742
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0740
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0739
Improper Access Control vulnerability in EmbedAI