Login Request a demo
Medium severity · published Apr 18, 2025
CVE-2025-28355
Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive information via the…
4.7
CVSS
0.2%
EPSS
No
On KEV
Description
Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Personal Management System · Personal-management-system
1.4.65 · source: NVD
Affected product
PM
Personal Management System
Personal-management-system
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-28355
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-28355
Product
https://github.com/Volmarg/personal-management-system
Issue Tracking
https://github.com/Volmarg/personal-management-system/issues/149
Exploit
https://github.com/abbisQQ/CVE-2025-28355/tree/main
More from Personal Management System
9.8
CVE-2024-29319
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file
7.8
CVE-2023-43838
An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's…
6.5
CVE-2025-29456
An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function
6.5
CVE-2025-29453
An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings component
6.5
CVE-2025-29455
An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" function