CVE-2025-64063

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard user can exploit this flaw by sending direct HTTP requests to administrative endpoints, bypassing the UI restrictions. This allows the attacker to manipulate data outside their assigned scope, including: Unauthorized Account modification, modifying/deleting arbitrary user accounts and changing passwords by sending a direct request to the user management API endpoint; Confidential Data Access, accessing and downloading sensitive organizational documents via a direct request to the document retrieval API; Privilege escalation, This vulnerability can lead to complete compromise of data integrity and confidentiality, and Privilege Escalation by manipulating core system functions.

• CWE-285

• https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64063.mdThird Party Advisory
• https://www.primakon.com/rjesenja/primakon-pcm/Product

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64055An issue was discovered in Fanvil x210 V2 2.12.20 allowing u…9.8
• CVE-2025-64056File upload vulnerability in Fanvil x210 V2 2.12.20 allows u…4.3
• CVE-2025-64057Directory traversal vulnerability in Fanvil x210 V2 2.12.20 …8.3
• CVE-2025-6406A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-64061Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerab…4.3
• CVE-2025-64062The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoin…8.8
• CVE-2025-64064Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to…8.8
• CVE-2025-64065The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endp…8.8
• CVE-2025-64066Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoin…8.6
• CVE-2025-64067Primakon Pi Portal 1.0.18 API endpoints responsible for retr…5.3
• CVE-2025-6407A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-64070Sourcecodester Student Grades Management System v1.0 is vuln…5.4