Vulnerability · Published Aug 10, 2025 · Assigned by VulDB

CVE-2025-8807xujeff tianti 天梯 save authorization

Medium 6.3

In plain English

A medium-severity missing authorization in tianti 天梯 from xujeff. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 62.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-admin/user/ajax/save. The manipulation leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
xujeff	tianti 天梯	2.02.12.22.3

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-319336 | xujeff tianti 天梯 save authorization vdb-entry
VDB-319336 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #626344 | Tianti Project Tianti 2.3 Missing Authorization third-party-advisory
https://github.com/N1n3b9S/cve/issues/15 issue-tracking
https://github.com/N1n3b9S/cve/issues/15#issue-3280910303 exploit, issue-tracking