CVE-2025-11322 Mangati NovoSGA User Creation new weak password
Attackers can create users with weak passwords due to insufficient validation in the NovoSGA user creation page, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11322?
CVE-2025-11322 is a medium-severity vulnerability in Mangati NovoSGA, published on 6 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-521
Which versions are affected by CVE-2025-11322?
2 open source packages ship an affected version, including novosga/novosga.
| Package | Affected | Fixed in |
|---|---|---|
novosga/novosga Packagist | All versions to 2.2.12 | None |
novosga/novosga Packagist | All versions to 2.2.12 | None |
How do I fix CVE-2025-11322?
No fix has been published for CVE-2025-11322 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11322 exists.
Sources
Also known as GHSA-xgr2-5837-hf48.