CVE-2025-8260

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

2.3 Low

A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.27%Up 0.3 points since Jul 28, 2025

What each source reports

CVE List Score used 2.3

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

Record: CVE-2025-8260
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 3.0: 3.1 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CVSS 2.0: 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C
Weakness: CWE-328, CWE-327
Updated: 2026-11-02

EUVDEUVD-2025-22853 2.3

Record: EUVD-2025-22853
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8rhv-2p84-6g62 1.3

A vulnerability has been found in Vaelsys 4.1.0 and classified as problematic. This vulnerability...

A vulnerability has been found in Vaelsys 4.1.0 and classified as problematic. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component MD4 Hash Handler. The manipulation of the argument xajaxargs leads to use of weak hash. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Record: GHSA-8rhv-2p84-6g62
CVSS 4.0: 1.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

NVD 1.3

Record: CVE-2025-8260
CVSS 4.0: 1.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 2.1 LowAV:N/AC:H/Au:S/C:P/I:N/A:N
Weakness: CWE-327, CWE-328
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8260 is a low vulnerability (CVSS 2.3) in Vaelsys, published July 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. No source names a fixed version.

References

Show 4 moreShow less