Dashboard / CVE-2025-54320

CVE-2025-54320

MEDIUM 1 PoC
MEDIUM Priority: 0.02 BB Relevance: 69/100
Published: 2025-11-18 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: Low

Description

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
ascertia signinghub < 8.6.8

References & Advisories (2)

Proof of Concept (1)

—
https://github.com/saykino/CVE-2025-54320
nomi-sec

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploitation Probability

0.35%
Raw Score 0.003520
Percentile 29.3%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00352
2026-11-13
0.00352
2026-11-12
0.00352
2026-11-10
0.00352
2026-11-09
0.00352
2026-11-08
0.00352
2026-11-07
0.00352
2026-11-06
0.00352
2026-11-05
0.00352

Intelligence Sources

nvd ref →

External Links