Vulnerability · Published Jun 16, 2025 · Assigned by VulDB

CVE-2025-6099szluyu99 gin-vue-blog PATCH Request manager.go improper authorization

Medium 5.3

In plain English

A medium-severity security flaw in gin-vue-blog from szluyu99. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Affected products (as reported)

Vendor	Product	Versions
szluyu99	gin-vue-blog	61dd11ccd296e8642a318ada3ef7b3f7776d2410

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-312568 | szluyu99 gin-vue-blog PATCH Request manager.go improper authorization vdb-entry
VDB-312568 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #589495 | szluyu99 https://github.com/szluyu99/gin-vue-blog commit 61dd11ccd296e8642a318ada3ef7b3f7776d2410 Improper Access Controls third-party-advisory
https://github.com/szluyu99/gin-vue-blog/issues/28 exploit, issue-tracking