Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-10320: iteachyou Dreamer CMS allows weak passwords to be set

CVE-2025-10320 · published 1 year ago

Summary

The iteachyou Dreamer CMS may allow users to set weak passwords, which could be exploited by attackers. This affects the /admin/user/updatePwd file. IT teams should update the CMS to a version that fixes this issue to prevent potential security risks.

Original advisory text

A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing manipulation results in weak password requirements. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

1.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-521Weak Password Requirements

Timeline

Published12 Sep 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-10320 · NVD

Track software like this

Free during beta