CVE Vulnerability Advisory Database

[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module

[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system

[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-47729

[Impact] The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which i...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Craft CMS versions prior to 4.15.3 and 5.7.5

[Impact] Unauthenticated attackers can inject arbitrary PHP code into session files, potentially leading to Remote Code Execution (RCE) when chained with an independent local file inclusion vulnerability.

[Mitigation] Immediately upgrade Craft CMS to the patched versions (4.15.3, 5.7.5, or higher).

[Affected Scope] SysAid On-Prem versions <= 23.3.40

[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application

[Affected Scope] SysAid On-Prem versions 23.3.40 and below

[Impact] Unauthenticated remote attackers can read arbitrary system files and perform administrator account takeover, leading to full system compromise.

[Mitigation] Immediately upgrade SysAid On-Prem to version 24.4.60 or higher, and restrict external access to the Checkin endpoint prior to patching.

[Affected Scope] Output Messenger versions prior to 2.0.63

[Impact] Authenticated attackers can leverage directory traversal sequences ('../') to access sensitive configuration files and arbitrary system files, potentially leading to remote code execution (RCE)

[Mitigation] Immediately upgrade Output Messenger to the latest secure version (2.0.63 or higher) and restrict network access

[Affected Scope] ConnectWise ScreenConnect versions 25.2.3 and earlier

[Impact] If machine keys are compromised by an attacker with privileged system-level access, they can inject a malicious ViewState to execute arbitrary code on the server

[Mitigation] Immediately upgrade to ScreenConnect 2025.4, which completely disables ViewState and removes its dependency

[Affected Scope] Commvault Web Server versions prior to 11.36.46, 11.32.89, 11.28.141, and 11.20.217 on Windows and Linux platforms

[Impact] An authenticated remote attacker can compromise the web server by creating and executing malicious webshells, leading to full system takeover.

[Mitigation] Immediately upgrade Commvault Web Server to the patched versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217 or higher).

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] SAP systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader component.

[Impact] Unauthenticated remote attackers can upload malicious executable binaries (such as web shells), leading to complete compromise of system confidentiality, integrity, and availability.

[Mitigation] Immediately apply the official security patch (SAP Note 3594142) and restrict external access to the Metadata Uploader endpoints.

[Affected Scope] Commvault Command Center Innovation Release versions 11.38.0 through 11.38.20.

[Impact] Unauthenticated remote attackers can upload malicious ZIP installation packages to execute arbitrary code (RCE) via path traversal and JSP web shell deployment.

[Mitigation] Immediately upgrade to patched versions: 11.38.20 with SP38-CU20-433/436 or 11.38.25 with SP38-CU25-434/438 or higher.

[Affected Scope] All mail server environments running Qualitia Active! mail 6 BuildInfo: 6.60.05008561 and earlier

[Impact] Unauthenticated remote attackers can execute arbitrary code or trigger a Denial-of-Service (DoS) condition by sending specially crafted HTTP requests

[Mitigation] Immediately apply the latest security patch provided by the vendor (Qualitia) and restrict external access to the webmail interface until patched

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1

[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system

[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Projects running Vite development server exposed to the network (via --host or server.host configuration) using versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11

[Impact] Remote attackers can bypass access restrictions and retrieve sensitive source code or system files by appending crafted query parameters (?inline&import or ?raw?import) to requests

[Mitigation] Immediately upgrade Vite to the patched versions (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11) and disable unnecessary external host binding (--host)

[Affected Scope] Kentico Xperience through version 13.0.178

[Impact] Authenticated attackers can exploit the Staging Sync Server to upload arbitrary files to relative paths, leading to server-side execution and full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict access to the Staging Sync Server endpoints

[Affected Scope] Kentico Xperience through version 13.0.178 with Staging Sync Server enabled

[Impact] Unauthenticated attackers can bypass authentication to control administrative objects, leading to full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict external access to the Staging Sync Server endpoint

[Affected Scope] Kentico Xperience versions up to and including 13.0.172

[Impact] Attackers can bypass authentication to gain administrative control, potentially leading to full system compromise and Remote Code Execution (RCE)

[Mitigation] Apply the official hotfix immediately, or restrict access to the Staging Sync Server endpoint via IP whitelisting

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched