CVE-2025-8853

critical · 9.3

Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.

9.3

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2025-08-11

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-290

References

https://www.chtsecurity.com/news/8618a2f0-390a-4506-9ff8-a9e74030d19e
https://www.chtsecurity.com/news/a9a90f0b-c2cb-4c66-b3d1-bc7f252fd108
https://www.twcert.org.tw/en/cp-139-10320-ad540-2.html
https://www.twcert.org.tw/tw/cp-132-10319-adc18-1.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-8853