CVE-2025-60375

Oct. 10, 2025, 3:16 p.m.

7.3
High

Description

The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.

Product(s) Impacted

Vendor Product Versions
Perfex
  • Crm
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-289
Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a perfex crm / / / / / / / /

References

https://github.com/AhamedYaseen03/CVE-2025-60375

Tags

cve@mitre.org
CWE-289
2025-10-09
CVE-2025-60375

CVSS Score

7.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: LOW

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

    View Vector String

Timeline

Published: Oct. 9, 2025, 9:15 p.m.
Last Modified: Oct. 10, 2025, 3:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.