CVE-2025-1108
Insufficient data authenticity vulnerability in Janto
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.6EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
07 Feb 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
Impronta · JantoWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →