CVE-2025-7896 | THREATINT

Description

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_video/delete_video of the file app/controllers/v1/video.py. The manipulation leads to path traversal. The attack can be launched remotely.

In harry0703 MoneyPrinterTurbo bis 1.2.6 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Das betrifft die Funktion download_video/delete_video der Datei app/controllers/v1/video.py. Mit der Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden.

Reserved 2025-07-19 | Published 2025-07-20 | Updated 2025-07-20 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR

Problem types

Path Traversal

Product status

1.2.0

affected

1.2.1

affected

1.2.2

affected

1.2.3

affected

1.2.4

affected

1.2.5

affected

1.2.6

affected

Timeline

2025-07-19:	Advisory disclosed
2025-07-19:	VulDB entry created
2025-07-19:	VulDB entry last update

Credits

zhangjx (VulDB User) reporter

References

vuldb.com/?id.317011 (VDB-317011 | harry0703 MoneyPrinterTurbo video.py delete_video path traversal) vdb-entry technical-description

vuldb.com/?ctiid.317011 (VDB-317011 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.608941 (Submit #608941 | Harry Yu MoneyPrinterTurbo v1.2.6 Unauthorized Access (Path Traversal)) third-party-advisory

vuldb.com/?submit.609041 (Submit #609041 | Harry Yu MoneyPrinterTurbo v1.2.6 未授权访问（路径遍历） (Duplicate)) third-party-advisory

cve.org (CVE-2025-7896)

nvd.nist.gov (CVE-2025-7896)

Download JSON