{"id":"CVE-2025-2595","aliases":["EUVD-2025-12244","GHSA-5937-p7hv-j7mh"],"status":"published","title":"Forced Browsing Vulnerability in CODESYS Visualization","description":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00464,"percentile":0.40457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-425"],"published":"2025-04-23T07:54:00Z","modified":"2026-06-17T09:07:15Z","products":[{"vendor":"codesys","product":"codesys visualization"}],"references":[{"url":"https://certvde.com/en/advisories/VDE-2025-027"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2595"},{"url":"https://github.com/advisories/GHSA-5937-p7hv-j7mh"}],"sources":{"cve":[{"id":"CVE-2025-2595","title":"Forced Browsing Vulnerability in CODESYS Visualization","description":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.","status":"published","published":"2025-04-23T07:54:00.43Z","modified":"2025-04-23T16:27:02.99Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-12244","description":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.","status":"published","published":"2025-04-23T07:54:00Z","modified":"2025-04-23T16:27:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:12.74685Z"}],"ghsa":[{"id":"GHSA-5937-p7hv-j7mh","title":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and...","description":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.","status":"published","published":"2025-04-23T09:33:32Z","modified":"2025-04-23T09:33:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T15:02:00.180386Z"}],"nvd":[{"id":"CVE-2025-2595","description":"An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.","status":"published","published":"2025-04-23T08:15:14.023Z","modified":"2026-06-17T09:07:15.153Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:11:01.507281Z"}]}}