CVE-2025-55744 Details
Description
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in UnoPim, an open-source Product Information Management (PIM) system built on Laravel. This issue affects versions prior to 0.2.1. Several endpoints lack proper CSRF protection, allowing attackers to perform state-changing actions on behalf of authenticated users. Vulnerable endpoints include those for editing products, categories, and attributes, among others.
To address this vulnerability, implement CSRF tokens for all state-changing requests and adjust the SameSite cookie attribute to 'Lax' or 'Strict'. Ensure that all state-changing actions are performed using POST requests instead of GET.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ | [email protected] | Exploit |
| https://github.com/unopim/unopim/security/advisories/GHSA-287x-6r2h-f9mw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webkul unopim | < 0.2.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 22, 2025 | Initial Analysis | [email protected] |
| Aug 21, 2025 | New CVE Received | [email protected] |