CVE-2025-62720: linkace before 2.4.0 (exclusive); +1 more affected products

CVE-2025-62720. CVSS 3.1 base score 6.5 (MEDIUM, NVD). EPSS 0.00396 (percentile 0.32228), scored 17-Oct-2026.

Affected technology

linkace · before 2.4.0 (exclusive)
linkace

LinkAce · < 2.4.0
Kovah

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can export the entire database of links from all users in the system, including private links that should only be accessible to their owners. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 18-Oct-2026 22:52 UTC

CWE: CWE-200, CWE-284
CCR priority: 26.1 /100 (P4)
CVSS 3.1: 6.5 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · NVD
EPSS: 0.00396 · percentile 0.32228 · 2026-10-17
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-62720.html