Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-55744: UnoPim lets attackers change product data without permission

CVE-2025-55744 · published 1 year ago

Summary

The UnoPim product information system could let a malicious website trick an authenticated user into adding or editing product records. This could lead to incorrect or unauthorized product information being stored. Updating UnoPim to version 0.2.1 or later resolves the issue.

What to do

Update unopim unopim to version 0.2.1.
Update webkul unopim to version 0.2.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	unopim	unopim	<= 0.2.0 Fix: upgrade to 0.2.1
–	webkul	unopim	< 0.2.1 `cpe:2.3:a:webkul:unopim::::::::`

Original advisory text

UnoPim vulnerable to CSRF on Product edit feature and creation of other types

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1.

References

https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ URL
https://github.com/unopim/unopim/security/advisories/GHSA-287x-6r2h-f9mw Vendor Advisory
https://github.com/advisories/GHSA-287x-6r2h-f9mw
https://nvd.nist.gov/vuln/detail/CVE-2025-55744 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55744... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published21 Aug 2025

Updated26 Oct 2026

First seen6 Mar 2026

Sources

GHSA-287x-6r2h-f9mw · GHSA

CVE-2025-55744 · NVD

CVE-2025-55744 · OSV

Track software like this

Free during beta