CVE-2025-3979 - dazhouda lecms Password Change index.php cross-site request forgery

Back Back to CVE browser

MEDIUM

dazhouda lecms Password Change index.php cross-site request forgery

Published Apr 27, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.30%

Description

A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Dazhouda Product Lecms Default
n/a
- Version
  3.0.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dazhouda

Lecms

n/a

Version	Status	Constraints
3.0.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (4)

https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_3.md
exploit
https://vuldb.com/?ctiid.306315
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.306315
vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.557787
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_3.md		exploit
https://vuldb.com/?ctiid.306315		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.306315		vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.557787		third-party-advisoryThird Party AdvisoryVDB Entry