CVE-2025-10161

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10161", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-09-09T12:49:55.496Z", "datePublished": "2025-11-11T12:42:50.253Z", "dateUpdated": "2026-06-05T10:50:04.252Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T10:50:04.252Z"}, "title": "Authentication Bypass in Turkguven's Perfektive", "datePublic": "2025-11-11T12:02:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-807", "description": "CWE-807 Reliance on Untrusted Inputs in a Security Decision", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-554", "descriptions": [{"lang": "en", "value": "CAPEC-554 Functionality Bypass"}]}], "affected": [{"vendor": "Turkguven Software Technologies Inc.", "product": "Perfektive", "versions": [{"status": "affected", "version": "0", "lessThan": "Version: 12574 Build: 2701", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.\n\nThis issue affects Perfektive: before Version: 12574 Build: 2701.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.<p>This issue affects Perfektive: before Version: 12574 Build: 2701.</p>"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0387", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0387", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "credits": [{"lang": "en", "value": "Ferit \u00d6ZNER", "type": "finder"}], "source": {"defect": ["TR-25-0387"], "advisory": "TR-25-0387", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T18:22:51.139313Z", "id": "CVE-2025-10161", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T18:22:58.881Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10161", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T18:22:51.139313Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T18:22:56.010Z"}}], "cna": {"title": "Authentication Bypass in Turkguven's Perfektive", "source": {"defect": ["TR-25-0387"], "advisory": "TR-25-0387", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ferit \u00d6ZNER"}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-554", "descriptions": [{"lang": "en", "value": "CAPEC-554 Functionality Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Turkguven Software Technologies Inc.", "product": "Perfektive", "versions": [{"status": "affected", "version": "0", "lessThan": "Version: 12574 Build: 2701", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-11-11T12:02:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0387", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0387", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.\n\nThis issue affects Perfektive: before Version: 12574 Build: 2701.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.<p>This issue affects Perfektive: before Version: 12574 Build: 2701.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-807", "description": "CWE-807 Reliance on Untrusted Inputs in a Security Decision"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-05T10:50:04.252Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10161", "state": "PUBLISHED", "dateUpdated": "2026-06-05T10:50:04.252Z", "dateReserved": "2025-09-09T12:49:55.496Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-11-11T12:42:50.253Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Perfektive", "vendor": "Turkguven Software Technologies Inc.", "versions": [{"lessThan": "Version: 12574 Build: 2701", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.\n\nThis issue affects Perfektive: before Version: 12574 Build: 2701."}, {"lang": "es", "value": "Restricci\u00f3n inadecuada de intentos excesivos de autenticaci\u00f3n, Aplicaci\u00f3n del lado del cliente de la seguridad del lado del servidor, Dependencia de entradas no confiables en una decisi\u00f3n de seguridad vulnerabilidad en Turkguven Software Technologies Inc. Perfektive permite Fuerza Bruta, omisi\u00f3n de autenticaci\u00f3n, Omisi\u00f3n de Funcionalidad. Este problema afecta a Perfektive: antes de la Versi\u00f3n: 12574 Compilaci\u00f3n: 2701."}], "id": "CVE-2025-10161", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10161", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T18:22:51.139313Z", "version": "2.0.3"}}]}, "published": "2025-11-11T13:15:43.593", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0387"}, {"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-25-0387"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-602"}, {"lang": "en", "value": "CWE-807"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"created": "2025-11-12T12:42:31.944163+00:00", "updated": "2025-11-12T12:42:31.944189+00:00", "vendors": ["turkguven", "turkguven$PRODUCT$perfektive"]}