{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T21:14:04.707","vulnerabilities":[{"cve":{"id":"CVE-2025-1270","sourceIdentifier":"cve-coordination@incibe.es","published":"2025-02-13T13:15:09.273","lastModified":"2026-01-29T19:27:51.417","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to refer to another user. In addition, the first request could also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vulnerability will be executed with the privileges of the impersonated user."},{"lang":"es","value":"La vulnerabilidad de referencia directa a objetos insegura (IDOR) en h6web de Anapi Group permite a un atacante autenticado acceder a la información de otros usuarios mediante una solicitud POST y modificando el parámetro “pkrelated” en el endpoint “/h6web/ha_datos_hermano.php” para hacer referencia a otro usuario. Además, la primera solicitud también podría permitir al atacante hacerse pasar por otros usuarios. Como resultado, todas las solicitudes realizadas después de la explotación de la vulnerabilidad IDOR se ejecutarán con los privilegios del usuario suplantado."}],"metrics":{"cvssMetricV31":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:anapi:h6web:-:*:*:*:*:*:*:*","matchCriteriaId":"50A1F49F-CA64-4AA2-BC41-C7F097F37BA2"}]}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web","source":"cve-coordination@incibe.es","tags":["Third Party Advisory"]}]}}]}