CVE-2025-47227
Published: 05 July 2025
Summary
CVE-2025-47227 is a high-severity Incorrect Provision of Specified Functionality (CWE-684) vulnerability in Scriptcase (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
In the Production Environment extension of Netmake ScriptCase through version 9.12.006 (23), the administrator password reset mechanism is mishandled such that an unauthenticated user can trigger a bypass simply by issuing both a GET and a POST request to login.php. The flaw is tracked as CVE-2025-47227 with a CVSS 3.1 score of 7.5 and is associated with CWE-684.
An unauthenticated remote attacker can exploit the weakness to seize control of the administrator account and thereby bypass authentication entirely. Successful exploitation grants the attacker the ability to modify or access administrative functions without any prior credentials or user interaction.
Public references, including the Synacktiv advisory and the linked GitHub repository, point to ScriptCase’s official changelog for remediation details; operators should review the changelog and apply any available updates that address the login.php handling. The associated EPSS score has remained flat at 0.0343 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20102
Vulnerability details
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic checks confirm that specified security and privacy functions are actually provided and operating.