CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH request, enabling them to impersonate any other arbitrary user, including application Administrators. This is due to a Broken Function Level Authorization failure (the function doesn't check the caller's privilege) compounded by an Insecure Design that permits a session switch without requiring the target user's password or an administrative token and only needs email of user.

• CWE-285

• https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64065.mdThird Party Advisory
• https://www.primakon.com/rjesenja/primakon-pcm/Product

Published

Nov 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64057Directory traversal vulnerability in Fanvil x210 V2 2.12.20 …8.3
• CVE-2025-6406A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-64061Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerab…4.3
• CVE-2025-64062The Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoin…8.8
• CVE-2025-64063Primakon Pi Portal 1.0.18 API endpoints fail to enforce suff…9.8
• CVE-2025-64064Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to…8.8
• CVE-2025-64066Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoin…8.6
• CVE-2025-64067Primakon Pi Portal 1.0.18 API endpoints responsible for retr…5.3
• CVE-2025-6407A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-64070Sourcecodester Student Grades Management System v1.0 is vuln…5.4
• CVE-2025-64074A path-traversal vulnerability in the logout functionality o…5.3
• CVE-2025-64075A path traversal vulnerability in the check_token function o…10