High severity · published Aug 20, 2025
CVE-2025-9241
elunez eladmin exportUser csv injection
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
eladmin · elunez
2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +2 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9241
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9241
Exploit
https://github.com/elunez/eladmin/issues/886
Exploit
https://github.com/elunez/eladmin/issues/886#issue-3307309824
Permissions Required
https://vuldb.com/?ctiid.320774
Third Party Advisory
https://vuldb.com/?id.320774
Third Party Advisory
https://vuldb.com/?submit.631473
More from eladmin
9.8
CVE-2024-7458
elunez eladmin Database Management/Deployment Management upload path traversal
7.5
CVE-2025-8530
elunez eladmin Druid application-prod.yml default credentials
7.2
CVE-2025-2855
elunez eladmin upload checkFile deserialization
6.5
CVE-2025-3250
elunez eladmin Maintenance Management Module testConnect deserialization
5.4
CVE-2025-9937
elunez eladmin LocalStorageController deleteFile improper authorization