{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-53118/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-53118/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-53118/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-53118/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-53118/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-53118"},"sightings":{"href":"/api/v1/sightings/cve-2025-53118"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.30525,"kev":false,"percentile":0.98159},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-53118.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-53118\n\ninfo:\n  name: Securden Unified PAM - Authentication Bypass\n  author: DhiyaneshDk,pussycat0x,iamnoooob,pdresearch\n  severity: critical\n  description: |\n    An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.\n  impact: |\n    Unauthenticated attackers can control administrator backup functions to compromise passwords, secrets, and application session tokens stored in Unified PAM.\n  remediation: |\n    Upgrade Securden Unified PAM to the latest version that implements proper authentication checks on backup functions.\n  reference:\n    - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-53118\n  metadata:\n    verified: true\n    max-request: 3\n    fofa-query: (icon_hash=\"1798893256\" || icon_hash=\"-766529773\")\n  tags: cve,cve2025,securden,pam,auth-bypass,vuln,vkev\n\nflow: http(1) & http(2) & http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /thirdparty-access HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n        internal: true\n\n  - raw:\n      - |\n        GET /get_csrf_token HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'token')\n          - contains(content_type, 'application/json')\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /get_date_picker_format HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'current_date')\n          - contains(content_type, 'application/json')\n        condition: and\n# digest: 4a0a00473045022100b0887a61d2b767aad87d01cc5f8e414cd1119ca508024e3f321f724e1e5af0fa02204e160ee9ae1eb2cd52ff42b5a5f4f6fde6e0e2193277e940bffd8647b94fd6f6:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-53118"}