CVE-2025-3960 is a high severity missing authorization flaw (CVSS 7.3) in withstars Books-Management-System 1.0. The page /allreaders.html in the background interface does not check who is asking. The maintainer no longer supports the product and the exploit is public, so remove or isolate it.
What's affected
The record names withstars Books-Management-System 1.0, in the background interface component, at the path /allreaders.html.
The record states that the product is no longer supported by the maintainer. That changes the advice. There is no fixed version to wait for, and the record names none. It also says the exploit has been disclosed to the public.
The CVSS vector shows network access, low complexity and no privileges required. Anyone who can reach the application can try the request.
How to check if you're exposed
This is a self hosted web application, so check where it lives rather than a package version.
- Search your servers and repositories for the project name and for the path /allreaders.html.
- Confirm whether the version is 1.0.
- Test your own deployment from outside your network to see whether the admin style paths answer without a login. Do this only on systems you own.
- Look in web server logs for requests to the path from addresses you do not recognise.
grep -c "allreaders.html" /var/log/nginx/access.log
Adjust the log path for your server. A high count from unknown addresses is worth a closer look.
What to do now
- Take the application off the internet, or require a VPN or single sign on at the proxy in front of it.
- Add an authorization check to every page in the background interface, based on a server side session and role, not on whether a link is visible.
- Plan to retire the product. With no maintainer, every future flaw in it is yours to fix.
- If it holds real records, review logs for past access to the affected pages and decide whether the data needs to be treated as exposed.
- Keep an inventory entry for it until it is gone, so it does not come back in a later audit.
Why it matters
The weaknesses are missing authorization (CWE-862) and incorrect authorization (CWE-863). The application serves a page without asking whether the caller is allowed to see it. Hiding a link from the menu is not access control. If the server will answer a direct request, the page is open.
Unsupported software makes this worse. A flaw like this one will never get an upstream fix, so the only real remedies are to wrap the app in controls you own or to replace it. Our free in-browser dependency scan can help you find out what else an old project pulls in, though it will not see this flaw, which sits in the application's own code.
This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Will the maintainer publish a fix?
The record says the product is no longer supported by the maintainer, so do not plan around a patch. Isolate the app or replace it.
Sources
The CVE record also lists third party write-ups and a VulDB entry. They are not vendor advisories, and this post does not reproduce any exploit detail from them.
Last reviewed: 18 October 2026.
