{"id":73175,"date":"2025-11-07T19:45:42","date_gmt":"2025-11-07T16:15:42","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-63691-pig-token-information-disclosure-and-privilege-escalation-vulnerability\/"},"modified":"2025-11-07T19:45:42","modified_gmt":"2025-11-07T16:15:42","slug":"cve-2025-63691-pig-token-information-disclosure-and-privilege-escalation-vulnerability","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-63691-pig-token-information-disclosure-and-privilege-escalation-vulnerability\/","title":{"rendered":"CVE-2025-63691 &#8211; Pig Token Information Disclosure and Privilege Escalation Vulnerability"},"content":{"rendered":"<p>CVE ID : CVE-2025-63691<\/p>\n<p>Published :  Nov. 7, 2025, 4:15 p.m. | 1\u00a0hour, 14\u00a0minutes ago<\/p>\n<p>Description : In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (\/api\/admin\/sys-token\/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator&#8217;s authentication Token through this interface, thereby forging an administrator account, gaining the system&#8217;s management permissions, and taking over the system.<\/p>\n<p>Severity: 0.0 | NA<\/p>\n<p>Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-63691 Published : Nov. 7, 2025, 4:15 p.m. | 1\u00a0hour, 14\u00a0minutes ago Description : In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (\/api\/admin\/sys-token\/page) has an improper permission verification issue, which leads to information leakage. This interface can be &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-73175","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/73175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=73175"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/73175\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=73175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=73175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=73175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}