Dashboard / CVE-2025-56425

CVE-2025-56425

CRITICAL
INFO Priority: 0.07 BB Relevance: 78/100
Published: 2026-01-08 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: High

Description

An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earlier of enaio 11.0, and in the AppConnctor component version 11.10.0.183 and earlier of enaio 11.10. The vulnerability allows authenticated remote attackers to inject arbitrary SMTP commands via crafted input to the /osrest/api/organization/sendmail endpoint

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
optimal-systems enaio 10.10.0.0 – 10.10.0.183

References & Advisories (2)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS — Exploitation Probability

0.74%
Raw Score 0.007410
Percentile 55.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00741
2026-11-12
0.00741
2026-11-10
0.00741
2026-11-09
0.00741
2026-11-08
0.00741
2026-11-07
0.00741
2026-11-06
0.00741
2026-11-05
0.00741
2026-11-04
0.00741

Intelligence Sources

nvd ref →

External Links