Dashboard / CVE-2025-67805

CVE-2025-67805

HIGH
MEDIUM Priority: 0.02 BB Relevance: 75/100
Published: 2026-04-01 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 2025_06_003.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
sagedpw sage_dpw 2025_06_004

References & Advisories (2)

https://pastebin.com/Tk4LgMG2
Third Party Advisory

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.30%
Raw Score 0.002990
Percentile 22.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00299
2026-11-13
0.00299
2026-11-12
0.00299
2026-11-10
0.00299
2026-11-09
0.00299
2026-11-08
0.00299
2026-11-07
0.00299
2026-11-06
0.00299
2026-11-05
0.00299
2026-11-04
0.00299

Intelligence Sources

nvd ref →

External Links