Log in Start free

Vulnerability · Published May 11, 2025 · Assigned by VulDB

CVE-2025-45461Panel-dev MaxKB Knowledge Base Module csv injection

Medium 4.7

In plain English

A medium-severity injection in MaxKB from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.10.8 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure.

Affected products (as reported)

VendorProductVersions
1Panel-dev MaxKB 1.10.01.10.11.10.21.10.31.10.41.10.51.10.61.10.7

Weakness: CWE-1236, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References