← Back to browse · API

CVE-2025-27590

Severity
CRITICAL
CVSS
9.0
EPSS
0.27573
Risk score
45.65
CISA KEV
No
PoC
No
Published
2025-03-03
Modified
2025-03-04
First seen
2026-08-07
Aliases
EUVD-2025-5558, GHSA-JX6P-9C26-G373
Products
Oxidized Web project:Oxidized Web 0 <0.15.0
Sources
euvd EUVD-2025-5558

Description

In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.

References