CVE-2025-70141: oretnom23 customer_support_system
Vulnerability summary
CVE-2025-70141 is a critical (CVSS 9.4) vulnerability in oretnom23 customer_support_system. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-02-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.08 pp
From 0.69% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (youngkevinn.github.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Oretnom231 product
1 vendor · 1 product
References
3 links- youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC/ExploitMitigationThird Party Advisory