← Database

CVE-2025-45994

HIGH CVSS: 7.5 Published: 2025-09-26 Modified: 2026-06-17

Description

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.

Affected Platforms

Arandasoft Passrecovery

Weakness Type

CWE-200

References