CVE-2025-27980

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27980
cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.csdn.net/qq_52469895/article/details/145496958?sharetype=blogdetail&sharerId=145496958&sharerefer=PC&sharesource=qq_52469895&spm=1011.2480.3001.8118 Third Party Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:cashbook:cashbook:4.0.3:*:*:*:*:*:*:*
History

21 May 2025, 19:47

Type Values Removed Values Added
References () https://blog.csdn.net/qq_52469895/article/details/145496958?sharetype=blogdetail&sharerId=145496958&sharerefer=PC&sharesource=qq_52469895&spm=1011.2480.3001.8118 - () https://blog.csdn.net/qq_52469895/article/details/145496958?sharetype=blogdetail&sharerId=145496958&sharerefer=PC&sharesource=qq_52469895&spm=1011.2480.3001.8118 - Third Party Advisory, Exploit
Summary
  • (es) cashbook v4.0.3 tiene una vulnerabilidad de lectura de archivos arbitrarios en /api/entry/flow/invoice/show?invoice=.
CPE cpe:2.3:a:cashbook:cashbook:4.0.3:*:*:*:*:*:*:*
First Time Cashbook
Cashbook cashbook

15 Apr 2025, 21:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-200

15 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-15 15:16

Updated : 2025-05-21 19:47

NVD link : CVE-2025-27980

Mitre link : CVE-2025-27980

CVE.ORG link : CVE-2025-27980

JSON object : View

Products Affected

cashbook

  • cashbook
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor