CVE-2025-14692

MEDIUM

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the at...

Affects 1 product across 1 vendor.

CVSS 3.16.1
CVSS v42.1
EPSS0.5%
Percentile38th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, can impact systems beyond the vulnerable component, no availability impact.
CWE Weakness Definitions
CWE-601: CWE-601
Related Attack Patterns (CAPEC)
CAPEC-178 Cross-Site Flashing
via CWE-601

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A flaw in Mayan EDMS up to version 4.10.1 allows for an open redirect vulnerability in the /authentication/ file, which can be exploited remotely. The exploit has been published and upgrading to version 4.10.2 is required to mitigate the risk.

BSID: BS-2025-GLOBAL-233922-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-14692?
A flaw in Mayan EDMS up to version 4.10.1 allows for an open redirect vulnerability in the /authentication/ file, which can be exploited remotely. The exploit has been published and upgrading to version 4.10.2 is required to mitigate the risk.
What is the CVSS score for CVE-2025-14692?
CVE-2025-14692 has CVSS 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS: 0.5%.
Is CVE-2025-14692 actively exploited?
No confirmed active exploitation of CVE-2025-14692 as of 2026-10-08.
How do I remediate CVE-2025-14692?
Priority: HIGH.
What systems are affected by CVE-2025-14692?
CVE-2025-14692 affects Mayan-Edms Mayan Edms.
Vulnerability Details
CVE IDCVE-2025-14692
BSIDBS-2025-GLOBAL-233922-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published2025-12-15
Last Modified2026-10-07
ICS Relevance0%
Weakness (CWE)
CWE-601
SourceNVD
Official Description

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is an open redirect in an unknown function of the /authentication/ file, which can be triggered remotely by an attacker to redirect users to malicious sites.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Mayan-Edms Mayan Edms < 4.10.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 305 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash70b9817e8b08798383515ccbe6fdb7803a8ef59d7287bf6e8c9fbf26171419db68d9912d1c1e35fbc70622d733d6950e21cbbc59381bf418cb7995890fe1b2eb
Related CVEs affecting Mayan-Edms
CVE-2018-16405 6.1 An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets w... CVE-2018-16406 6.1 An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS ... CVE-2018-16407 6.1 An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS beca... CVE-2025-14691 6.1 A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element... CVE-2022-47419 5.4 An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exp...
View all Mayan-Edms CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →