High · 8.3 CVE-2025-29995 EUVD-2025-6264GHSA-2rrx-p33r-295r

Account Takeover Vulnerability in CAP back office application

Published Mar 13, 2025 · Updated Mar 13, 2025 · Assigned by CERT-In

Vendor: Rising Technosoft Product: CAP back office application

Description

This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.

Affected products

Vendor	Product	Affected	Fixed
Rising Technosoft	CAP back office application	<2.0.4	—

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048 third-party-advisory