CVE-2025-9240 - CVE House

Back to Database

Status published Medium CVE-2025-9240

elunez eladmin info information disclosure

5.3 CVSS

Vulnerability Description

A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9240

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

ez-lbz (VulDB User)

References

More from elunez

View All →

elunez eladmin LocalStorageController deleteFile improper authorization

elunez eladmin exportUser csv injection

elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

elunez eladmin Druid application-prod.yml default credentials

elunez eladmin Maintenance Management Module testConnect deserialization

Affected Vendor

elunez

View all reports →

Affected Software

eladmin

Vulnerable Versions:

2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7

Timeline

Official Publish: August 20th, 2025

Last Modified: August 20th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-200 CWE-284

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1565.002 Stored Data Manipulation