Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-57564

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CubeAPM是CubeAPM公司的一个代码开发工具。 CubeAPM nightly-2025-08-01-1版本存在安全漏洞，该漏洞源于未经验证的攻击者可通过/api/logs/insert/elasticsearch/_bulk端点注入任意日志条目，可能导致日志投毒和性能下降。

AI Predicted 7.5 Difficulty: Easy EPSS 0.35% · P27

Possible ATT&CK Techniques 1 AI

T1565.002 · Transmitted Data Manipulation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-57564

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform unauthorized log injection. Exploitation may lead to false log entries, log poisoning, alert obfuscation, and potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform and is not limited to specific deployment configurations.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CubeAPM 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CubeAPM是CubeAPM公司的一个代码开发工具。 CubeAPM nightly-2025-08-01-1版本存在安全漏洞，该漏洞源于未经验证的攻击者可通过/api/logs/insert/elasticsearch/_bulk端点注入任意日志条目，可能导致日志投毒和性能下降。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2025-57564

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-57564

请登录查看更多情报信息。

Proof of Concept for CVE-2025-57564 (1)

Same Patch Batch · n/a · 2025-10-07 · 6 CVEs total

CVE-2025-11362 7.5 HIGH pdfmake 安全漏洞
CVE-2025-50505 Clash Verge Rev 安全漏洞
CVE-2025-60312 SourceCodester Markdown to HTML Converter 安全漏洞
CVE-2025-56243 PuneethReddyHC Event Management 安全漏洞
CVE-2025-52021 Online Shopping System Advanced 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2025-57564

No comments yet

Leave a comment