CVE-2025-65899

MEDIUM 5.3CVE-2025-65899 · Published 04/12/2025 · updated 04/11/2026

In short

CVE-2025-65899 is a MEDIUM (CVSS 5.3) vulnerability affecting kalmia (difuse).
Chance of exploitation in the next 30 days (EPSS): 0.37%, higher than 30.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kalmia difuse	`= 0.2.0`	No fix yet

Description

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.

References

DifuseHQ/Kalmia · Product
Noxurge/CVE-2025-65899 · Exploit

More vulnerabilities in kalmia

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free