CVE-2025-0744

Improper Access Control vulnerability in EmbedAI

CVSS 7.5 HIGHEPSS 0.3%CWE-284

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 ene 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Productos afectados

EmbedAI · EmbedAI

Referencias

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai