Medium severity · published Sep 3, 2025
CVE-2025-9937
elunez eladmin LocalStorageController deleteFile improper authorization
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
eladmin · elunez
1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9937
vuldb.com
https://vuldb.com/?ctiid.322339
vuldb.com
https://vuldb.com/?id.322339
vuldb.com
https://vuldb.com/?submit.643392
www.cnblogs.com
https://www.cnblogs.com/aibot/p/19063329
More from eladmin
9.8
CVE-2024-7458
elunez eladmin Database Management/Deployment Management upload path traversal
7.5
CVE-2025-9241
elunez eladmin exportUser csv injection
7.5
CVE-2025-8530
elunez eladmin Druid application-prod.yml default credentials
7.2
CVE-2025-2855
elunez eladmin upload checkFile deserialization
6.5
CVE-2025-3250
elunez eladmin Maintenance Management Module testConnect deserialization