Medium severity · published Apr 4, 2025
CVE-2025-3250
elunez eladmin Maintenance Management Module testConnect deserialization
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
eladmin · elunez
2.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3250
Permissions Required
https://vuldb.com/?ctiid.303320
Third Party Advisory
https://vuldb.com/?id.303320
Third Party Advisory
https://vuldb.com/?submit.546132
Permissions Required
https://www.yuque.com/u520611/giuhru/vfvchim8sphv2y1g?singleDoc
More from eladmin
9.8
CVE-2024-7458
elunez eladmin Database Management/Deployment Management upload path traversal
7.5
CVE-2025-9241
elunez eladmin exportUser csv injection
7.5
CVE-2025-8530
elunez eladmin Druid application-prod.yml default credentials
7.2
CVE-2025-2855
elunez eladmin upload checkFile deserialization
5.4
CVE-2025-9937
elunez eladmin LocalStorageController deleteFile improper authorization