Vulnerability · Published Oct 8, 2025 · Assigned by INCIBE
CVE-2025-10352Missing Authorization vulnerability in Melis Platform
Critical 9.3
In plain English
A critical-severity missing authorization in Melis Platform from Melis Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | melisplatform/melis-core | 5.3.11 | GHSA-p3vc-g9f9-mgw4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Melis Technology | Melis Platform | 0 – before 5.3.11 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N