{"id":"CVE-2025-3691","aliases":["EUVD-2025-11290","GHSA-88gp-q3v3-9qmm"],"status":"published","title":"mirweiye Seven Bears Library CMS Add Link server-side request forgery","description":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00617,"percentile":0.50035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2025-04-16T13:00:15Z","modified":"2026-06-17T09:20:29Z","products":[{"vendor":"mirweiye","product":"seven bears library cms"},{"vendor":"mirweiye","product":"seven_bears_library_cms"}],"references":[{"url":"https://vuldb.com/?id.304980","tags":["vdb-entry","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.304980","tags":["signature","permissions-required","Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?submit.553507","tags":["third-party-advisory","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/KKDT12138/CVE/blob/main/cve2.pdf","tags":["exploit","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3691"},{"url":"https://github.com/advisories/GHSA-88gp-q3v3-9qmm"}],"sources":{"cve":[{"id":"CVE-2025-3691","title":"mirweiye Seven Bears Library CMS Add Link server-side request forgery","description":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-04-16T13:00:15.026Z","modified":"2025-04-16T13:13:03.592Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"},{"version":"3.0","score":2.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"},{"version":"2.0","score":3.3,"vector":"AV:N/AC:L/Au:M/C:N/I:P/A:N","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:32:39.378527Z"}],"euvd":[{"id":"EUVD-2025-11290","description":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-04-16T13:00:15Z","modified":"2025-04-16T13:13:03Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:25.86191Z"}],"ghsa":[{"id":"GHSA-88gp-q3v3-9qmm","title":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as...","description":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-04-16T15:34:38Z","modified":"2025-04-16T15:34:43Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:01:34.863019Z"}],"nvd":[{"id":"CVE-2025-3691","description":"A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add Link Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-04-16T13:15:53.38Z","modified":"2026-06-17T09:20:29.697Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:N/AC:L/Au:M/C:N/I:P/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:11:00.456643Z"}]}}