Vulnerability · Published Mar 12, 2025 · Assigned by VulDB

CVE-2025-2218LoveCards LoveCardsV2 Setting other access control

Medium 5.3

In plain English

A medium-severity improper access control in LoveCardsV2 from LoveCards. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 44.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
LoveCards	LoveCardsV2	2.3.02.3.12.3.2

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

VDB-299290 | LoveCards LoveCardsV2 Setting other access control vdb-entry
VDB-299290 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #512351 | LoveCards LoveCardsV2 2.3.2 External Control of System or Configuration Setting third-party-advisory
https://ctf-n0el4kls.notion.site/LoveCardsV2-Unauthentication-to-RCE-Vulnerability-19841990f44780de8263c1f77a007a83?pvs=4 exploit