{"id":"CVE-2025-66956","aliases":["EUVD-2025-208597","GHSA-798g-p7qc-9jv4"],"status":"published","title":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...","description":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00552,"percentile":0.46576,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-284"],"published":"2026-03-11T00:00:00Z","modified":"2026-07-05T02:17:32Z","exploits":[{"source":"pocgithub","id":"TheWoodenBench/CVE-2025-66956","title":"TheWoodenBench/CVE-2025-66956","date":"2025-12-15","url":"https://github.com/TheWoodenBench/CVE-2025-66956"}],"references":[{"url":"https://github.com/TheWoodenBench/CVE-2025-66956"},{"url":"https://live.asee.io/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66956"},{"url":"http://asseco.com"},{"url":"http://live.com"},{"url":"https://live.asee.io"},{"url":"https://github.com/advisories/GHSA-798g-p7qc-9jv4"}],"sources":{"cve":[{"id":"CVE-2025-66956","description":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.","status":"published","published":"2026-03-11T00:00:00Z","modified":"2026-07-05T01:30:56.885Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-208597","description":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.","status":"published","published":"2026-03-11T00:00:00Z","modified":"2026-07-05T01:30:56Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:14.793418Z"}],"ghsa":[{"id":"GHSA-798g-p7qc-9jv4","title":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...","description":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.","status":"published","published":"2026-03-11T21:31:03Z","modified":"2026-03-13T21:32:49Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:06:36.943588Z"}],"nvd":[{"id":"CVE-2025-66956","description":"Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.","status":"published","published":"2026-03-11T21:16:13.037Z","modified":"2026-07-05T02:17:32.097Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}