{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Impersonation",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nNon-sanitised submission of malicious SVG files on the Edupage portal in\ncombination with CSRF vulnerability allows triggering various actions on\nbehalf of other users, e.g. identity spoofing, sending fake messages,\ngiving fake approvals, etc.\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage web and mobile application - multiple pages with missing CSRF token\nand multiple pages allowing attachment uploads.\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70562\nCVE-2025-70563\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/4"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Impersonation attacks on Edupage portal",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0252",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4",
            "automated": true,
            "contentSha256": "af883f4d6525af5afb39baf60c32c4eeb9f767b44447dc0edb11edda3a94e42b",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:46:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0252"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}