{"id":"CVE-2025-27581","aliases":["EUVD-2025-12155","GHSA-6565-r3qg-5289"],"status":"published","title":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users...","description":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00378,"percentile":0.32093,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-425"],"published":"2025-04-23T00:00:00Z","modified":"2026-06-17T09:03:50Z","exploits":[{"source":"pocgithub","id":"Henryisnotavailable/CVE-2025-27581","title":"Henryisnotavailable/CVE-2025-27581","date":"2025-07-30","url":"https://github.com/Henryisnotavailable/CVE-2025-27581"}],"products":[{"vendor":"nih","product":"brics"}],"references":[{"url":"https://github.com/brics-dev/brics"},{"url":"https://brics.cit.nih.gov"},{"url":"https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27581/README.md"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27581"},{"url":"https://github.com/advisories/GHSA-6565-r3qg-5289"}],"sources":{"cve":[{"id":"CVE-2025-27581","description":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.","status":"published","published":"2025-04-23T00:00:00Z","modified":"2025-04-24T14:54:44.316Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-12155","description":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.","status":"published","published":"2025-04-23T00:00:00Z","modified":"2025-04-24T14:54:44Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:04.724433Z"}],"ghsa":[{"id":"GHSA-6565-r3qg-5289","title":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users...","description":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.","status":"published","published":"2025-04-24T00:31:19Z","modified":"2025-04-24T00:31:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T15:02:00.72042Z"}],"nvd":[{"id":"CVE-2025-27581","description":"NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.","status":"published","published":"2025-04-24T00:15:16.45Z","modified":"2026-06-17T09:03:50.173Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:11:01.507281Z"}]}}