CVE-2025-5512

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-287

• https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.mdExploit, Third Party Advisory
• https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#32attackers-can-bypass-screen-lock-to-access-the-backendExploit, Third Party Advisory
• https://vuldb.com/?ctiid.310926Permissions Required, VDB Entry
• https://vuldb.com/?id.310926Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.584491Third Party Advisory, VDB Entry

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55113If the Access Control List is enforced by the Control-M/Agen…10
• CVE-2025-55114The improper order of AUTHORIZED_CTM_IP validation in the Co…6.9
• CVE-2025-55115A path traversal in the Control-M/Agent can lead to a local …9.3
• CVE-2025-55116A buffer overflow in the Control-M/Agent can lead to a local…9.3
• CVE-2025-55117A stack-based buffer overflow can be remotely triggered when…6.3
• CVE-2025-55118Memory corruptions can be remotely triggered in the Control-…8.9
• CVE-2025-55123Improper neutralization of input in Revive Adserver 5.5.2 an…5.4
• CVE-2025-55124Improper neutralisation of input in Revive Adserver 6.0.0+ c…6.1
• CVE-2025-55125This vulnerability allows a Backup or Tape Operator to perfo…9.8
• CVE-2025-55126HackerOne community member Dang Hung Vi (vidang04) has repor…6.5
• CVE-2025-55127HackerOne community member Dao Hoang Anh (yoyomiski) has rep…5.4
• CVE-2025-55128HackerOne community member Dang Hung Vi (vidang04) has repor…6.5