CVE-2025-10819
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was detected in the fuyang_lipengjun platform 1.0 in the UserCouponController function of /usercoupon/queryAll. Manipulation leads to improper authorization, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
Improper authorization may allow an attacker to access data or functions they should not have permission for, potentially leading to information leakage or data modification. Since the exploit is public, the risk of exploitation is high.
Recommendation
Immediately review authorization mechanisms in UserCouponController and implement proper access controls. It is also recommended to monitor unusual requests to /usercoupon/queryAll.
Other vulnerabilities in fuyang_lipengjun platform
See all- CVE-2025-10822Medium
A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-10821Medium
A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used.
- CVE-2025-10820Medium
A vulnerability was detected in fuyang_lipengjun platform 1.0. It impacts the function TopicController of the file /topic/queryAll. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used.
Original NVD description (English source)
A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS