Vulnerability Database

314,614

Total vulnerabilities in the database

CVE-2025-65899

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.

  • Published: Dec 4, 2025
  • Updated: Dec 11, 2025
  • CVE: CVE-2025-65899
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWEs:

Software From Fixed in
difuse / kalmia 0.2.0 0.2.0.x