CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-0744: Improper Access Control vulnerability in EmbedAI
7.5
CVSS
Description
an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.
Classification
CVE ID: CVE-2025-0744
CVSS Base Severity: HIGH
CVSS Base Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
Vendor: EmbedAI
Product: EmbedAI
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.77% (scored less or equal to compared to others)
EPSS Date: 2025-02-28 (when was this score calculated)