CVE Vulnerability Advisory Database

[Affected Scope] FreePBX endpoint module versions 15, 16, and 17

[Impact] Unauthenticated remote attackers can bypass authentication, manipulate the database, and execute arbitrary code with administrator privileges

[Mitigation] Immediately upgrade the FreePBX endpoint module to patched versions (15.0.66, 16.0.89, or 17.0.3) and restrict administrator access

[Affected Scope] Adobe Experience Manager (AEM) versions 6.5.23 and earlier (specifically with Forms module and Struts DevMode enabled)

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands or code with system privileges

[Mitigation] Apply the official Adobe APSB25-82 security patch immediately and disable Struts DevMode in production environments

[Affected Scope] DELMIA Apriso from Release 2020 through Release 2025

[Impact] Unauthenticated remote attackers can bypass authorization checks to gain privileged access to the application

[Mitigation] Apply official security patches immediately, restrict external access, and enforce IP-based access control lists

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-6204

[Impact] An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 coul...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-53770

[Impact] Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network....

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Windows development and build environments utilizing eslint-config-prettier package versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7

[Impact] Installation of the compromised package triggers automatic execution of install.js, dropping and executing the node-gyp.dll malware to compromise the host system

[Mitigation] Immediately uninstall the compromised versions, force-downgrade or upgrade to a clean version, and scan systems for malicious DLL files

[Affected Scope] CrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23, specifically when the DMZ proxy feature is not utilized.

[Impact] Unauthenticated remote attackers can bypass AS2 validation via HTTPS to obtain full administrative access, which has been actively exploited in the wild.

[Mitigation] Immediately upgrade to CrushFTP 10.8.5, 11.3.4_23, or later, or restrict direct HTTPS access and enable the DMZ proxy feature.

[Affected Scope] All Wing FTP Server installations running versions prior to 7.4.4

[Impact] Attackers can disclose the full local installation path of the application by supplying an excessively long value in the UID cookie, facilitating subsequent targeted attacks

[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and deploy WAF rules to restrict anomalous cookie lengths in the interim

[Affected Scope] User and admin web interfaces of Wing FTP Server before version 7.4.4

[Impact] Unauthenticated attackers (including anonymous FTP accounts) can inject arbitrary Lua code into session files, leading to remote code execution with root or SYSTEM privileges

[Mitigation] Immediately upgrade Wing FTP Server to version 7.4.4 or later, and restrict external access to the web administration interface

[Affected Scope] On-premises deployments of Microsoft SharePoint Server

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to perform network-based spoofing, potentially accessing sensitive internal data

[Mitigation] Immediately apply the official Microsoft security updates and restrict external network access to SharePoint web ports

[Affected Scope] On-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition

[Impact] An authorized attacker can inject and execute arbitrary code over the network, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft security patches and restrict network access to SharePoint management endpoints

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-6554

[Impact] Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules

[Affected Scope] Users of unpatched RARLAB WinRAR installations

[Impact] Remote attackers can execute arbitrary code in the context of the current user by tricking them into opening a crafted archive file, leading to directory traversal and unauthorized file creation

[Mitigation] Immediately upgrade WinRAR to the latest secure version and avoid extracting archives from untrusted sources

[Affected Scope] Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.

[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.

[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11

[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)

[Affected Scope] TeleMessage services and associated JSP applications through 2025-05-05

[Impact] Local attackers can extract plaintext passwords and sensitive credentials previously transmitted over HTTP by analyzing memory heap dumps

[Mitigation] Apply the latest security patches, restrict access to heap dump files, and optimize JVM garbage collection to prevent sensitive data from persisting in memory

[Affected Scope] TeleMessage service deployments through 2025-05-05

[Impact] Unauthenticated remote attackers can download the JVM heap dump via the exposed /heapdump endpoint, leading to the extraction of sensitive credentials, API keys, and user data from memory

[Mitigation] Disable the heapdump Actuator endpoint immediately, restrict external access via reverse proxies/WAFs, and rotate all potentially compromised credentials

[Affected Scope] Versa Concerto SD-WAN orchestration platform versions 12.1.2 through 12.2.0

[Impact] Unauthenticated attackers can bypass authentication via Traefik misconfiguration to access administrative and internal Actuator endpoints, potentially exposing heap dumps and trace logs containing sensitive credentials

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to administrative and Actuator endpoints

[Affected Scope] Samsung MagicINFO 9 Server versions prior to 21.1052

[Impact] Unauthenticated remote attackers can exploit path traversal to write arbitrary files with system authority, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade MagicINFO 9 Server to version 21.1052 or later and restrict external access