CVE-2025-47227

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

2.05% chance of exploitation in the next 30 days, 80th percentile

Published

2025-07-05

Updated

2025-07-07

Proof-of-concept exploits (2)

• Outs1d3r-Net/CVE-2025-47227
• synacktiv/CVE-2025-47227_CVE-2025-4722811★ · 2025-05-14

References

• CVE Record
• NVD entry

Related

• CVE-2018-6789
• CVE-2019-15846
• CVE-2019-8942
• CVE-2020-27950
• CVE-2020-9289
• CVE-2021-1782