CVE-2023-25263

5.5 mediumEPSS 0.2%

Medium (5.5) in stimulsoft designer. EPSS 0.2% chance of exploitation in the next 30 days.

In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-312
Published: 2023-03-27
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

stimulsoft:designer

References

https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa
https://cves.at/posts/cve-2023-25263/writeup/
https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa
https://cves.at/posts/cve-2023-25263/writeup/

Check your stack JSON