CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2025-03-10

Last modified

2025-03-11

Weaknesses

CWE-352

Affected products

• Tianti (Tianti Project)

References

• https://github.com/xujeff/tianti/issues/39