GCVE-1988-2026-0251

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Edupage",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nBoth authenticated and publicly accessible anonymous guest accounts on\nEdupage portal allow an attacker to capture the complete list of user IDs,\nnames (students, parents, and teachers), and the associated banking details\n(IBAN codes)\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage Payment module\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70561\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/3"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0251",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3",
            "automated": true,
            "contentSha256": "f0c00c3375b0a15c7991e33bfcc9c10bad4a82e4ecefb8da5d4667c2d9748705",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:39:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0251"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}