CVE-2025-32367
The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 0.43%
- CWE
- CWE-425
- Published
- 2025-04-11
- Last modified
- 2026-03-13
Affected products
- Oz Forensics face recognition application
Weakness type
Related vulnerabilities
- CVE-2026-78051 — alexta69 MeTube Cookie File cookies.txt file access
- CVE-2026-14953 — Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control
- CVE-2026-76799 — code-projects Login Registration System SQL Database Backup login_registration_system.sql file access
- CVE-2026-19903 — SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
- CVE-2026-60011 — Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly...
- CVE-2026-21760 — Unauthorized Access to Admin Functionality via Forced Browsing
- CVE-2024-23573 — HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that...
- CVE-2026-13533 — agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access