CVE-2025-51741

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-51741
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51741.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-51741
Published
2025-11-25T21:15:55.743Z
Modified
2026-04-10T05:32:20.763748Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the downstream users.

References

Affected packages

Git / github.com/Veal98/Echo

Affected ranges

Type
GIT
Repo
https://github.com/Veal98/Echo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
78ee5ed462b1c2798e681e3bce70767f6a3ec1b5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f8e1d70d71a79e16f6f2f726b52df97570368f06
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3"
        }
    ]
}

Affected versions

v2.*
v2.0
v2.1
v2.2
v2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51741.json"