CVE-2025-10352: 
PHP vulnerability analysis and mitigation

CVE-2025-10352 is a critical security vulnerability discovered in the melis-core module of Melis Technology's Melis Platform. The vulnerability was disclosed on October 8, 2025, and affects versions prior to 5.3.11. This vulnerability allows an unauthenticated attacker to create an administrator account through a request to '/melis/MelisCore/ToolUser/addNewUser' (INCIBE Notice).

The vulnerability has been assigned a CVSS v4.0 base score of 9.3 (CRITICAL) with the vector string AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability is classified as CWE-862 (Missing Authorization), indicating a fundamental security control failure in the authentication mechanism (INCIBE Notice).

The vulnerability's impact is severe as it allows unauthorized attackers to create administrator accounts in the system, effectively bypassing all authentication controls. This could lead to complete system compromise, as administrator accounts typically have full access to all platform features and sensitive data (INCIBE Notice).

The vulnerability has been fixed by the Melis Technology team in the melis-core module version 5.3.11. Users are strongly advised to upgrade to this version or later to protect against potential exploitation (INCIBE Notice).