274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials

published 2025-03-15 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7563

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-03-17)

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

cnblogs.com https://www.cnblogs.com/aibot/p/18732299 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

274056675 springboot-openai-chatgpt

Classification

Weakness

CWE-798 Use of Hard-coded Credentials
CWE-259 Use of Hard-coded Password

References

cnblogs.com /aibot/p/18732299
exploit, third-party-advisory
vuldb.com /?id.299751
vdb-entry, third-party-advisory
vuldb.com /?ctiid.299751
signature, permissions-required, vdb-entry
vuldb.com /?submit.505694
third-party-advisory, vdb-entry

Sources

CVE List CVE-2025-2322
NVD CVE-2025-2322

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary