Medium severity · published Jan 30, 2025
CVE-2025-0744
Improper Access Control vulnerability in EmbedAI
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EmbedAI · EmbedAI
before 2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0744
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
More from EmbedAI
6.5
CVE-2025-0745
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0742
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0740
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0739
Improper Access Control vulnerability in EmbedAI
5.4
CVE-2025-0747
Stored Cross-Site vulnerability in EmbedAI