{"timestamp":"2025-07-28T15:57:53.324478Z","id":"CVE-2025-8260","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Vaelsys","product":"VaelsysV4","modules":["Web interface"],"versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.1.0","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3","status":"affected"},{"version":"5.4.0","status":"affected"},{"version":"5.1.1","status":"unaffected"},{"version":"5.4.1","status":"unaffected"}]}]

2.3

1.3

A vulnerability has been found in Vaelsys 4.1.0 and classified as problematic. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component MD4 Hash Handler. The manipulation of the argument xajaxargs leads to use of weak hash. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.

https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html

https://vuldb.com/submit/616922

https://vuldb.com/vuln/317848

https://vuldb.com/vuln/317848/cti

https://vuldb.com/?ctiid.317848

https://vuldb.com/?id.317848

https://vuldb.com/?submit.616922

https://vuldb.com/?ctiid.317848 Types: Permissions Required, VDB Entry

https://vuldb.com/?id.317848 Types: Third Party Advisory, VDB Entry

https://vuldb.com/?submit.616922 Types: Third Party Advisory, VDB Entry

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-327

OR
          *cpe:2.3:a:vaelsys:vaelsys:4.1.0:*:*:*:*:*:*:*

VulDB: https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md Types: Exploit, Third Party Advisory

VulDB: https://vuldb.com/?ctiid.317848 Types: Permissions Required, VDB Entry

VulDB: https://vuldb.com/?id.317848 Types: Third Party Advisory, VDB Entry

VulDB: https://vuldb.com/?submit.616922 Types: Third Party Advisory, VDB Entry

A vulnerability has been found in Vaelsys 4.1.0 and classified as problematic. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component MD4 Hash Handler. The manipulation of the argument xajaxargs leads to use of weak hash. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

(AV:N/AC:H/Au:S/C:P/I:N/A:N)

CWE-327

CWE-328

https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md

https://vuldb.com/?ctiid.317848

https://vuldb.com/?id.317848

https://vuldb.com/?submit.616922