CVE-2025-63561
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server's connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.
Risk Assessment
Exhaustion of server resources prevents legitimate users and APIs from accessing the service. This is a risk to the availability of the platform.
Recommendation
Upgrade the platform to version 1.0.2 or later. Additionally, implement connection timeouts and Slowloris protection at the proxy server level.
Other vulnerabilities in Summer Pearl Group Vacation Rental Management Platform
See all- CVE-2025-63563Medium
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
- CVE-2025-63562Medium
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).
Original NVD description (English source)
Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS