Dashboard / CVE-2025-46047

CVE-2025-46047

MEDIUM 1 PoC
MEDIUM Priority: 0.02 BB Relevance: 83/100
Published: 2025-09-02 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
silverpeas silverpeas 6.4.1
silverpeas silverpeas 6.4.2

References & Advisories (2)

Proof of Concept (1)

★ 2
https://github.com/J0ey17/CVE-2025-46047
nomi-sec

Bug Bounty Relevance

83 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.36%
Raw Score 0.003550
Percentile 29.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00355
2026-11-12
0.00355
2026-11-10
0.00355
2026-11-09
0.00355
2026-11-08
0.00355
2026-11-07
0.00355

Intelligence Sources

nvd ref →

External Links