Vulnerability · Published Aug 20, 2025 · Assigned by VulDB
CVE-2025-9241elunez eladmin exportUser csv injection
Medium 6.3
In plain English
A medium-severity injection in eladmin from elunez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 73.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
Affected products (as reported)
Weakness: CWE-1236, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-320774 | elunez eladmin exportUser csv injection vdb-entry, technical-description
- VDB-320774 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #631473 | elunez eladmin ≤ 2.7 CSV/XLSX Injection(CWE-1236) third-party-advisory
- https://github.com/elunez/eladmin/issues/886 issue-tracking
- https://github.com/elunez/eladmin/issues/886#issue-3307309824 exploit, issue-tracking