Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vpgv-cr97-kffs
Vulnerability ID VCID-vpgv-cr97-kffs
Aliases CVE-2025-7900
GHSA-rc5f-3hfv-jxp2
Summary The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-7900
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-7900
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-7900
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-7900
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rc5f-3hfv-jxp2
cvssv4 5.3 https://github.com/in2code-de/femanager
generic_textual MODERATE https://github.com/in2code-de/femanager
cvssv4 5.3 https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069
generic_textual MODERATE https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-7900
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-7900
cvssv4 5.3 https://typo3.org/security/advisory/typo3-ext-sa-2025-010
generic_textual MODERATE https://typo3.org/security/advisory/typo3-ext-sa-2025-010
ssvc Track https://typo3.org/security/advisory/typo3-ext-sa-2025-010
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-7900
https://github.com/in2code-de/femanager
https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069
https://nvd.nist.gov/vuln/detail/CVE-2025-7900
GHSA-rc5f-3hfv-jxp2 https://github.com/advisories/GHSA-rc5f-3hfv-jxp2
typo3-ext-sa-2025-010 https://typo3.org/security/advisory/typo3-ext-sa-2025-010
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/in2code-de/femanager
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://github.com/in2code-de/femanager/commit/9bd9fbded4cf31f69bfe03c55d406e79050f8069
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-7900
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Found at https://typo3.org/security/advisory/typo3-ext-sa-2025-010
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-22T14:11:59Z/ Found at https://typo3.org/security/advisory/typo3-ext-sa-2025-010
Exploit Prediction Scoring System (EPSS)
Percentile 0.42279
EPSS Score 0.00202
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:05:56.876476+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/7xxx/CVE-2025-7900.json 38.6.0