{"api_version":"1","generated_at":"2026-07-24T20:09:24+00:00","cve":"CVE-2021-25648","urls":{"html":"https://cve.report/CVE-2021-25648","api":"https://cve.report/api/cve/CVE-2021-25648.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-25648","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-25648"},"summary":{"title":"CVE-2021-25648","description":"Mobile application \"Testes de Codigo\" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters \"isAdmin\" and \"isPremium\" located on device storage.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-02-16 15:15:00","updated_at":"2023-08-08 14:22:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/","name":"https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/","refsource":"MISC","tags":["Mailing List","Third Party Advisory"],"title":"CVE-2021-25648 - Privilege Escalation on Mobile Application \"Testes de Código\"","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25648","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25648","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"25648","vulnerable":"1","versionEndIncluding":"11.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"testes-codigo","cpe5":"testes_de_codigo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"android","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25648","vulnerable":"1","versionEndIncluding":"11.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"testes-codigo","cpe5":"testes_de_codigo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"iphone_os","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-25648","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Mobile application \"Testes de Codigo\" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters \"isAdmin\" and \"isPremium\" located on device storage."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/","url":"https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/"}]}},"nvd":{"publishedDate":"2021-02-16 15:15:00","lastModifiedDate":"2023-08-08 14:22:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:testes-codigo:testes_de_codigo:*:*:*:*:*:android:*:*","versionEndIncluding":"11.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:testes-codigo:testes_de_codigo:*:*:*:*:*:iphone_os:*:*","versionEndIncluding":"11.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"25648","Ordinal":"200471","Title":"CVE-2021-25648","CVE":"CVE-2021-25648","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"25648","Ordinal":"1","NoteData":"Mobile application \"Testes de Codigo\" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters \"isAdmin\" and \"isPremium\" located on device storage.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"25648","Ordinal":"2","NoteData":"2021-02-16","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"25648","Ordinal":"3","NoteData":"2021-02-16","Type":"Other","Title":"Modified"}]}}}