QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-67806

Back to search

CVE-2025-67806

Published: Apr 1, 2026

Modified: May 10, 2026

PUBLISHED

CVSS v3.1

3.7

LOW

Description

The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.

VendorProductVersions

n/a

n/a

affected
n/a

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N

Attack Complexity

High

Attack Vector

Network

Availability

None

Confidentiality

Low

Integrity

None

Privileges Required

None

Scope

Unchanged

User Interaction

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now