In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.00665·Published 2025-04-15·Fixed in 1.7CWE-94
A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environme…
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.00494·Published 2025-04-15·Fixed in 1.7CWE-1039
AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood of HTTP GET requests, possibly related to display of HTTP log data by the GUI.
THREATIST.IORead the docs