Vulnerability in Mangati Novosga
CVE-2025-11322
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Mangati Novosga — versions 2.2.0, 2.2.1, 2.2.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (related)
- cna@vuldb.com (exploit, broken-link)
Frequently asked questions
- What is CVE-2025-11322?
- CVE-2025-11322 is a low-severity vulnerability in Mangati Novosga, classified under Weak Password Requirements. CVSS score: 3.7/10. Published 2025-10-06.
- How severe is CVE-2025-11322?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2025-11322 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.