CVE-2025-10084 - CVE House

Back to Database

Status published Medium CVE-2025-10084

elunez eladmin SysLogController 1 queryErrorLogDetail improper authorization

5.3 CVSS

Vulnerability Description

A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10084

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

aibot88 (VulDB User)

References

More from elunez

View All →

elunez eladmin LocalStorageController deleteFile improper authorization

elunez eladmin exportUser csv injection

elunez eladmin info information disclosure

elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

elunez eladmin Druid application-prod.yml default credentials

Affected Vendor

elunez

View all reports →

Affected Software

eladmin

Vulnerable Versions:

2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7

Timeline

Official Publish: September 8th, 2025

Last Modified: September 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-285 CWE-266

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Defense Evasion

T1484 Domain or Tenant Policy Modification

Defense Evasion