Weak Password Recovery in Shenzhen Sixun Software Business Management System
CVE-2025-14696

6.9MEDIUM

Key Information:

Vendor

Shenzhen Sixun Software

Status
Sixun Shanghui Group Business Management System
Vendor
CVE Published:
15 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-14696?

A vulnerability exists in the Sixun Shanghui Group Business Management System version 4.10.24.3, affecting the API endpoint for batch password updates. This flaw allows attackers to exploit weak password recovery mechanisms, potentially leading to unauthorized access. The vulnerability can be triggered remotely, and exploits are available in the public domain. Despite early notification to the vendor regarding this security issue, there has been no response. Users are strongly advised to assess their security posture and implement safeguards to mitigate potential risks.

Affected Version(s)

Sixun Shanghui Group Business Management System 4.10.24.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-14696 - Proof of Concept

References

https://vuldb.com/?id.336414
vdb-entry
https://vuldb.com/?ctiid.336414
signaturepermissions-required
https://vuldb.com/?submit.705601
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

yaozhangYiqiyin (VulDB User)
JSON
.
CVE-2025-14696 : Weak Password Recovery in Shenzhen Sixun Software Business Management System