CVE-2025-0465
Published: 14 January 2025
Summary
CVE-2025-0465 is a medium-severity Improper Input Validation (CWE-20) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0465 is a deserialization vulnerability in AquilaCMS version 1.412.13, rated as critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue affects unknown functionality in the /api/v2/categories endpoint, where manipulation of the PostBody.populate argument triggers improper input validation (CWE-20) and deserialization of untrusted data (CWE-502).
An unauthenticated remote attacker can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability.
Advisories from VulDB and a publicly available exploit in a GitHub Gist confirm the issue, noting that the vendor was contacted early about the disclosure but provided no response. No patches or official mitigations are mentioned.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1693
Vulnerability details
A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely.…
more
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public web API endpoint via deserialization flaw.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly addresses the improper input validation (CWE-20) by requiring validation of the PostBody.populate argument to prevent deserialization of untrusted data (CWE-502).
SI-2 mandates identification, reporting, and correction of flaws like CVE-2025-0465 in AquilaCMS, including patching or mitigating the deserialization vulnerability.
SC-7 implements boundary protections such as web application firewalls to monitor and block malicious remote requests to the vulnerable /api/v2/categories endpoint.