rafaelcorvino1/CVE-2025-53640

PoC

Broken Object Level Authorization (BOLA) in CERN's Indico leads to authenticated user enumeration.

view exploit source poc_in_githubauthor rafaelcorvino1published 2025-07-19catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2025-53640US	medium6.5OT elevated	0.66% (51st)	Exploit	2025-07-14
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint use…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.