---METADATA---
VENDOR: TMS Global Software
PRODUCT: TMS Management Console
AFFECTED_VERSIONS: v.6.3.7.27386.20250818
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in the TMS Management Console logo upload feature allows remote attackers to execute arbitrary code.

Executive Summary:
A critical file upload vulnerability in the TMS Global Software Management Console allows remote attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2025-69828

Affected Software: TMS Global Software TMS Management Console

Affected Versions: v.6.3.7.27386.20250818

Vulnerability: This is a remote code execution vulnerability originating from improper validation of file uploads in the /Customer/AddEdit endpoint, which can be exploited by an unauthenticated remote attacker.

Business Impact

With a CVSS score of 10, this vulnerability represents the highest level of risk, enabling complete system compromise. An attacker gaining code execution capabilities can take full control of the management console, potentially leading to total system takeover, lateral movement across the network, and complete data breach.

Remediation Plan

Immediate Action: Update the TMS Management Console to the latest available version provided by TMS Global Software.

Proactive Monitoring: Review web server logs for suspicious file upload requests or unauthorized access to the /Customer/AddEdit path.

Compensating Controls: Implement a Web Application Firewall (WAF) to block non-image file types from being uploaded to the management console and restrict access to the administration interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability demands immediate attention due to its critical severity and potential for full system compromise. Administrators must prioritize patching the affected console software to prevent unauthorized remote code execution.

---METADATA---
VENDOR: p2r3
PRODUCT: Bareiron
AFFECTED_VERSIONS: commit 8e4d40
---END_METADATA---

Description Summary:
A write-what-where condition in p2r3 Bareiron allows unauthenticated attackers to execute arbitrary code by sending a crafted packet that writes arbitrary values to memory.

Executive Summary:
A critical memory corruption vulnerability in p2r3 Bareiron allows unauthenticated remote attackers to execute arbitrary code via malicious network packets.

Vulnerability Details

CVE-ID: CVE-2025-69809

Affected Software: p2r3 Bareiron

Affected Versions: commit 8e4d40

Vulnerability: This is a "write-what-where" memory corruption flaw. An unauthenticated attacker can send a specially crafted network packet that triggers an out-of-bounds write, allowing them to overwrite critical memory addresses with arbitrary values.

Business Impact

The impact is Critical (CVSS 9.8) as it provides a direct path to unauthenticated Remote Code Execution (RCE). An attacker can gain full control over the affected system, leading to data theft, system destruction, or persistent access within the environment. This is particularly dangerous for low-level or "bare iron" software where security boundaries are minimal.

Remediation Plan

Immediate Action: Update to the latest commit or version of Bareiron that includes the fix for this memory corruption issue.

Proactive Monitoring: Use network intrusion detection systems (IDS) to look for malformed or unusual packets targeting the Bareiron service ports.

Compensating Controls: Implement network segmentation to isolate the Bareiron service and limit its exposure to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 16, 2026, there is no public information indicating active exploitation. However, memory corruption vulnerabilities are highly reliable for RCE and are often targeted by sophisticated actors.

Analyst Recommendation

The ability for an unauthenticated attacker to execute code via the network makes this a top-priority remediation item. Ensure the software is updated to a patched version immediately to close this critical security gap.

---METADATA---
VENDOR: Bareiron
PRODUCT: p2r3
AFFECTED_VERSIONS: Commit 8e4d40
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The p2r3 Bareiron component is vulnerable to an out-of-bounds memory access error, potentially leading to information disclosure or service disruption.

Executive Summary:
An unauthenticated out-of-bounds memory access vulnerability in Bareiron p2r3 allows remote attackers to trigger a Denial of Service or access sensitive memory regions.

Vulnerability Details

CVE-ID: CVE-2025-69808

Affected Software: Bareiron p2r3

Affected Versions: Commit 8e4d40

Vulnerability: The vulnerability exists as an out-of-bounds memory access issue triggered by the processing of a specially crafted network packet. Because the flaw is reachable by unauthenticated attackers, it presents a significant remote attack vector.

Business Impact

Successful exploitation allows an attacker to crash the service, resulting in operational downtime, or potentially leak sensitive information stored in memory. With a CVSS score of 9.1, this vulnerability represents a major risk to service availability and data confidentiality, particularly for systems exposed to untrusted networks.

Remediation Plan

Immediate Action: Identify systems running the affected commit (8e4d40) and restrict network access to these components until a vendor-supplied patch is available.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual traffic patterns targeting the p2r3 component.

Compensating Controls: Deploy a network-level firewall or Intrusion Prevention System (IPS) to filter suspicious traffic and block malformed packets before they reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its unauthenticated nature and the potential for memory corruption. Organizations should prioritize isolating affected systems and tracking the vendor's security disclosures for the release of an official patch.

---METADATA---
VENDOR: MojoPortal
PRODUCT: MojoPortal CMS
AFFECTED_VERSIONS: v2.9.0.1
---END_METADATA---

Description Summary:
MojoPortal CMS is vulnerable to a "Zip Slip" exploit in the SkinList.aspx endpoint, allowing attackers to execute arbitrary commands via a specially crafted zip file upload.

Executive Summary:
MojoPortal CMS version 2.9.0.1 is vulnerable to a critical Zip Slip flaw that enables attackers to achieve remote code execution by uploading malicious archives.

Vulnerability Details

CVE-ID: CVE-2025-69770

Affected Software: MojoPortal CMS

Affected Versions: v2.9.0.1

Vulnerability: This is a directory traversal vulnerability (Zip Slip) occurring during the extraction of zip files via the /DesignTools/SkinList.aspx endpoint. By crafting a zip file with ".." sequences in filenames, an attacker can write files to arbitrary locations on the server filesystem.

Business Impact

A successful exploit allows for arbitrary file writes, which typically leads to Remote Code Execution (RCE) by overwriting system files or uploading web shells. This results in a total compromise of the server, potential data exfiltration, and significant downtime. The CVSS score of 10 represents the maximum possible risk level.

Remediation Plan

Immediate Action: Update MojoPortal CMS to the latest secure version and restrict access to the DesignTools directory to trusted administrative IP addresses only.

Proactive Monitoring: Audit the filesystem for unexpected files in the web root and monitor for any suspicious process execution originating from the web server user.

Compensating Controls: Implement file integrity monitoring (FIM) and ensure the web server service runs with the least privilege possible to limit the impact of a file write.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 13, 2026, active exploitation has not been reported. However, Zip Slip vulnerabilities are highly critical and frequently targeted due to their high impact and relative ease of exploitation.

Analyst Recommendation

With a CVSS score of 10, this vulnerability requires an emergency response. Organizations must patch MojoPortal immediately to prevent attackers from gaining full system-level access through the skin upload functionality.

Executive Summary:
A critical vulnerability has been identified in multiple Tenda networking products, including the Tenda AX3 router. This flaw, a stack-based buffer overflow, can be exploited by a remote attacker to execute arbitrary code, effectively granting them complete control over the affected device. Successful exploitation could lead to network traffic interception, data theft, or the compromise of other devices on the internal network.

Vulnerability Details

CVE-ID: CVE-2025-69764

Affected Software: Tenda Multiple Products

Affected Versions: Tenda AX3 firmware v16.03.12.11 is confirmed to be vulnerable. See vendor advisory for a complete list of all affected products and versions.

Vulnerability: The vulnerability is a stack-based buffer overflow within the formGetIptv function of the device's firmware. The function fails to properly validate the size of user-supplied input before copying it into a fixed-size stack buffer named stbpvid. An unauthenticated remote attacker can exploit this by sending a specially crafted request containing an overly long value for the associated parameter, causing the buffer to overflow. This overflow can overwrite critical data on the stack, including the function's return address, allowing the attacker to redirect the program's execution flow to malicious shellcode and achieve remote code execution with the privileges of the device's web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit would result in a complete compromise of the network device, which often serves as the gateway to the internet and the primary firewall for a network segment. The business impact includes a high risk of data breaches through traffic interception (e.g., capturing credentials and sensitive information), loss of network availability, and the potential for attackers to use the compromised device as a pivot point to attack other internal systems. Furthermore, the compromised router could be conscripted into a botnet for use in larger-scale attacks against other organizations, causing significant reputational damage.

Remediation Plan

Immediate Action: Immediately apply the latest firmware updates provided by Tenda to all affected devices. After patching, it is crucial to monitor for any signs of post-remediation exploitation attempts and review device access logs for any anomalous activity that occurred prior to the update.

Proactive Monitoring: Implement network monitoring to detect suspicious traffic patterns originating from or directed to the Tenda devices. System and web server logs on the devices should be reviewed for unusually long or malformed requests, particularly those targeting IPTV-related functionalities. Configure Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) with signatures to detect and block common buffer overflow attack patterns.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Ensure the device's administrative web interface is not exposed to the public internet (WAN).
• Restrict access to the administrative interface to trusted IP addresses or a dedicated management VLAN.
• Implement network segmentation to limit the potential impact of a compromised router on critical internal assets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of January 22, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, due to the critical severity and the nature of the flaw, it is highly likely that security researchers and threat actors will develop exploit code in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability represents a severe risk to the security of the network perimeter. Although it is not currently listed on the CISA KEV catalog and is not under active exploitation, the potential for complete device takeover warrants immediate action. We strongly recommend that all organizations using affected Tenda products prioritize the deployment of the vendor-supplied firmware updates to mitigate the risk of compromise.

Executive Summary:
A high-severity SQL Injection vulnerability in the Events Manager WordPress plugin allows an unauthenticated attacker to exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-6970

Affected Software: WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability allows an unauthenticated attacker to execute time-based SQL injection attacks. The flaw exists due to insufficient sanitization of user-supplied input to the 'orderby' parameter, enabling the attacker to manipulate database queries and infer database content.

Business Impact

A successful exploit could allow an attacker to exfiltrate sensitive information from the underlying WordPress database, including user credentials, personal data, and other confidential site content. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to data confidentiality and integrity, potentially leading to reputational damage and regulatory penalties.

Remediation Plan

Immediate Action:
Immediately update the Events Manager plugin to the latest patched version provided by the vendor. If the plugin is no longer required, it should be deactivated and removed entirely.

Proactive Monitoring:
Monitor web server and database logs for unusually long query execution times or suspicious SQL syntax targeting the affected plugin's functionality, particularly involving the 'orderby' parameter.

Compensating Controls:
Implement and configure a Web Application Firewall (WAF) with rules designed to detect and block common SQL injection patterns as a virtual patch pending the update.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of SQL injection flaws, the potential for future exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for complete database compromise by an unauthenticated attacker, immediate action is required. We strongly recommend prioritizing the application of the vendor-supplied update to the Events Manager plugin to prevent potential data breaches and unauthorized access.

---METADATA---
VENDOR: Netgate
PRODUCT: pfSense CE
AFFECTED_VERSIONS: 2.8.0
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Netgate pfSense CE 2.8.0 contains a potential code execution vulnerability in the XMLRPC API via the pfsense.exec_php function.

Executive Summary:
A vulnerability in Netgate pfSense CE 2.8.0 allows authenticated administrators to execute arbitrary PHP code through the XMLRPC API.

Vulnerability Details

CVE-ID: CVE-2025-69691

Affected Software: Netgate pfSense CE

Affected Versions: 2.8.0

Vulnerability: The vulnerability involves the pfsense.exec_php function within the XMLRPC API. While the vendor disputes the finding, noting that this functionality is restricted to authenticated administrative users, it effectively allows for arbitrary PHP code execution within the system environment.

Business Impact

The CVSS score of 9.9 suggests an extremely high impact, though it is mitigated by the requirement for administrative authentication. If an attacker compromises an administrator's credentials, they can gain full control over the firewall, potentially leading to total network compromise and traffic interception.

Remediation Plan

Immediate Action: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts to mitigate the risk of unauthorized access to the XMLRPC API.

Proactive Monitoring: Audit logs for any administrative activity involving the XMLRPC API or unexpected changes to system configurations.

Compensating Controls: Restrict access to the XMLRPC interface to trusted IP addresses only, limiting the attack surface for potential credential-based attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. While the vendor classifies this as intended functionality for administrators, it remains a critical risk factor if administrative accounts are compromised.

Analyst Recommendation

While the vendor views this as an administrative feature, the risk of "living off the land" by an attacker with stolen credentials is significant. Security teams should prioritize the protection of administrative credentials and limit API access to known, authorized sources to minimize the risk of abuse.

---METADATA---
VENDOR: Netgate
PRODUCT: pfSense CE
AFFECTED_VERSIONS: 2.7.2
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Netgate pfSense CE 2.7.2 is vulnerable to arbitrary code execution via the module installer when processing a maliciously crafted serialized PHP object.

Executive Summary:
A critical remote code execution vulnerability in Netgate pfSense CE 2.7.2 could allow authenticated administrators to execute arbitrary PHP code on the underlying system.

Vulnerability Details

CVE-ID: CVE-2025-69690

Affected Software: Netgate pfSense CE

Affected Versions: 2.7.2

Vulnerability: This vulnerability involves an insecure deserialization flaw within the module installer, which can be triggered by providing a backup file containing a malicious serialized PHP object. The attack requires an authenticated administrator session to execute.

Business Impact

The vulnerability carries a CVSS score of 9.1, reflecting its critical potential for full system compromise. While the vendor disputes the finding, arguing that administrative access is required and intended, any unauthorized or coerced administrative access would allow an attacker to gain complete control over the network gateway, leading to total data interception or network disruption.

Remediation Plan

Immediate Action: Review current security policies regarding administrative access and ensure that only authorized personnel have access to the module installer and backup restoration functions.

Proactive Monitoring: Monitor system logs for unauthorized access to the module installation interface and investigate any irregular or high-privilege activity performed by administrative accounts.

Compensating Controls: Restrict access to the pfSense web interface to trusted management IP addresses to prevent unauthorized administrative sessions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this vulnerability, administrators should prioritize the principle of least privilege for all administrative accounts. While the vendor considers this a design feature, organizations must treat this as a high-risk vector for lateral movement and system compromise.

Executive Summary:
A high-severity SQL injection vulnerability has been identified in the GeoPandas library. This flaw allows a remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. Organizations using affected versions are at significant risk of a data breach and should apply the recommended remediation actions immediately.

Vulnerability Details

CVE-ID: CVE-2025-69662

Affected Software: The GeoPandas Project GeoPandas Library

Affected Versions: See vendor advisory for specific affected versions; versions prior to the patched release are vulnerable.

Vulnerability: The vulnerability is a SQL injection flaw within the GeoPandas library. The library fails to properly sanitize user-supplied input when constructing SQL queries for interacting with a database. An attacker can exploit this by providing specially crafted input that is appended to the underlying SQL query, allowing them to execute arbitrary SQL commands with the same privileges as the application's database user. This could lead to bypassing authentication controls, reading sensitive data from any table, modifying or deleting data, and in some database configurations, executing commands on the underlying operating system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. Successful exploitation could have a severe impact on the business, leading to a significant data breach of confidential or sensitive information stored in the connected database. Potential consequences include financial loss, reputational damage, regulatory fines, and loss of customer trust. The ability for an attacker to modify or delete data could also lead to operational disruption and compromise data integrity.

Remediation Plan

Immediate Action:

• Apply Vendor Patches: Immediately upgrade the GeoPandas library to the latest patched version as recommended by the vendor. This is the most effective way to permanently resolve the vulnerability.
• Review Database Access Controls: Audit the permissions of the database user account utilized by the application. Ensure it operates under the principle of least privilege, with access restricted to only the databases and tables necessary for its function.
• Enable Query Logging: Enable and monitor detailed logging for the database server. This will help detect and investigate potential exploitation attempts by capturing all executed queries.

Proactive Monitoring:

• Monitor database logs for suspicious queries, such as those containing UNION operators, stacked queries (e.g., using semicolons), or unexpected commands like DROP TABLE or SELECT from system tables.
• Analyze application and web server logs for unusual input patterns or errors that could indicate failed or successful injection attempts.
• Set up alerts for high-volume or anomalous query activity originating from the application server.

Compensating Controls:

• If patching is not immediately feasible, implement strict input validation and sanitization within the application layer to neutralize malicious characters before they are passed to the GeoPandas library.
• Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rulesets designed to detect and block common SQL injection attack patterns.
• Further segment the network to isolate the database server, restricting direct access from non-essential systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 31, 2026, this vulnerability has been recently disclosed, and there is no known public proof-of-concept exploit code available. There are currently no reports of this vulnerability being actively exploited in the wild. However, due to the critical nature of SQL injection flaws, threat actors are likely to develop exploits for this vulnerability in the near future.

Analyst Recommendation

Given the high CVSS score of 8.6, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of your data. We strongly recommend that organizations prioritize the immediate application of vendor-supplied patches to all affected systems. While this CVE is not currently on the CISA KEV list, its severity makes it a likely candidate for future inclusion. The remediation and monitoring steps outlined in this report should be implemented without delay to mitigate the risk of exploitation.

---METADATA---
VENDOR: Dolibarr
PRODUCT: Dolibarr ERP & CRM
AFFECTED_VERSIONS: v.22.0.9
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Dolibarr ERP & CRM v.22.0.9 allows remote attackers to escalate privileges by manipulating the notes field in perms.php.

Executive Summary:
Dolibarr ERP & CRM is vulnerable to a CSRF attack that can be used to escalate user privileges, potentially granting attackers administrative access to the entire business platform.

Vulnerability Details

CVE-ID: CVE-2025-69634

Affected Software: Dolibarr ERP & CRM

Affected Versions: v.22.0.9

Vulnerability: This CSRF vulnerability exists in the perms.php file. By tricking an authenticated administrator into visiting a malicious website, an attacker can silently execute actions on the administrator's behalf to modify permissions and escalate their own account's privileges.

Business Impact

With a CVSS score of 9.0, this is a critical threat to business operations. Privilege escalation in an ERP/CRM system allows attackers to access sensitive financial data, customer information, and corporate secrets, leading to severe financial and legal consequences.

Remediation Plan

Immediate Action: Update Dolibarr ERP & CRM to a version later than 22.0.9 that includes proper CSRF token validation for all sensitive actions.

Proactive Monitoring: Review user permission change logs for unexpected modifications and educate staff on the risks of clicking suspicious links while logged into administrative sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with CSRF protection enabled and ensure that administrative sessions have short timeout durations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation. However, CSRF attacks are a common method for targeting administrative users in web-based business applications.

Analyst Recommendation

The ability to escalate privileges through CSRF is a major security flaw. It is critical to apply the vendor's security patches immediately and to enforce strict session management policies to protect the integrity of the ERP/CRM environment.

---METADATA---
VENDOR: Moo Chan Song
PRODUCT: Moo Chan Song v4
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in Moo Chan Song v4 allows unauthenticated attackers to access sensitive files on the host system.

Executive Summary:
Moo Chan Song v4 is vulnerable to a path traversal flaw that enables remote, unauthenticated attackers to read arbitrary files from the server.

Vulnerability Details

CVE-ID: CVE-2025-69620

Affected Software: Moo Chan Song v4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a path traversal vulnerability in Moo Chan Song v4. It allows an unauthenticated attacker to bypass directory restrictions by using special character sequences (e.g., "../") in input parameters to access files outside the intended web root.

Business Impact

The business impact is high, as evidenced by the CVSS score of 7.5. Attackers could exfiltrate sensitive configuration files, source code, or system credentials, leading to a complete compromise of the application and the underlying server infrastructure. This poses a severe risk to data confidentiality and organizational security.

Remediation Plan

Immediate Action: Apply the vendor's security patch for Moo Chan Song v4 immediately to fix the improper input validation in file handling routines.

Proactive Monitoring: Review access logs for requests containing directory traversal patterns, such as "dot-dot-slash" sequences, directed at the application's file-serving endpoints.

Compensating Controls: Configure the web server to run with the least privilege and use a Web Application Firewall (WAF) to block path traversal attack signatures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Path traversal is a well-understood and frequently exploited vulnerability class.

Analyst Recommendation

Immediate action is required to patch Moo Chan Song v4. Organizations must ensure that the software is updated to prevent unauthenticated attackers from gaining access to sensitive system files and potentially escalating their privileges within the network.

---METADATA---
VENDOR: Deutsche Telekom AG
PRODUCT: Telekom Account Management Portal
AFFECTED_VERSIONS: versions before 2025-10-24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing 2FA rate-limiting vulnerability in the Telekom Account Management Portal allows for unlimited brute-force retries and complete MFA bypass.

Executive Summary:
The Telekom Account Management Portal is vulnerable to an authentication bypass flaw that permits attackers to circumvent multi-factor authentication through brute-force attacks.

Vulnerability Details

CVE-ID: CVE-2025-69615

Affected Software: Deutsche Telekom AG Telekom Account Management Portal

Affected Versions: Versions before 2025-10-24

Vulnerability: This is an improper access control vulnerability resulting from a lack of rate-limiting on multi-factor authentication (MFA) requests. An unauthenticated attacker can perform unlimited brute-force attempts to guess MFA codes, leading to a full authentication bypass.

Business Impact

Successful exploitation grants an attacker full access to user accounts within the portal, leading to unauthorized data exposure, potential identity theft, and compromise of sensitive customer information. Given the CVSS score of 9.1, this vulnerability poses a critical risk to organizational data integrity and regulatory compliance.

Remediation Plan

Immediate Action: Upgrade to the patched version released on 2025-11-03 to ensure rate-limiting controls are active.

Proactive Monitoring: Review authentication logs for patterns of high-frequency failed MFA attempts originating from single or distributed IP addresses.

Compensating Controls: Implement stricter IP-based access controls and monitor for anomalous login traffic via a Web Application Firewall (WAF) until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security failure in the authentication chain. Administrators must prioritize the application of the vendor-provided patch immediately to prevent unauthorized access and protect user credentials from brute-force compromise.

---METADATA---
VENDOR: Deutsche Telekom AG
PRODUCT: Telekom Account Management Portal
AFFECTED_VERSIONS: versions before 2025-10-27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An activation token reuse vulnerability in the password-reset endpoint of the Telekom Account Management Portal allows unauthorized password resets and full account takeover.

Executive Summary:
A critical vulnerability in the Telekom Account Management Portal allows unauthenticated attackers to perform unauthorized password resets, resulting in total account takeover.

Vulnerability Details

CVE-ID: CVE-2025-69614

Affected Software: Deutsche Telekom AG Telekom Account Management Portal

Affected Versions: Versions before 2025-10-27

Vulnerability: This vulnerability involves the improper handling of activation tokens within the password-reset workflow. By reusing valid tokens, an attacker can bypass standard security checks to reset passwords for arbitrary accounts without user interaction.

Business Impact

The ability to perform unauthorized password resets leads to total account takeover, enabling attackers to hijack user sessions, exfiltrate private data, and perform administrative actions. With a CVSS score of 9.4, this vulnerability is critical and places the entire user base at high risk of account compromise.

Remediation Plan

Immediate Action: Apply the vendor-provided update released on 2025-10-31 to enforce proper token invalidation.

Proactive Monitoring: Monitor password-reset request logs for spikes in activity or suspicious patterns of token usage that deviate from established baselines.

Compensating Controls: Deploy WAF rules designed to identify and block repeated attempts to access password-reset endpoints with identical or malformed tokens.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides an trivial path for attackers to gain full control over user accounts. Immediate patching is required to prevent large-scale account takeover events and maintain the security posture of the portal.

Executive Summary:
A high-severity vulnerability has been identified in GitLab Community and Enterprise Editions, which could allow a remote, unauthenticated attacker to compromise the platform. Successful exploitation could lead to unauthorized access to sensitive source code, disruption of software development pipelines, and potential takeover of the underlying server. Organizations are urged to apply security patches immediately to mitigate the significant risk to intellectual property and operational integrity.

Vulnerability Details

CVE-ID: CVE-2025-6948

Affected Software: GitLab Community Edition (CE) and Enterprise Edition (EE)

Affected Versions: All versions starting from 17.0.0. See vendor advisory for specific patched versions.

Vulnerability: This vulnerability is a critical path traversal flaw within the web interface component responsible for handling repository imports. An unauthenticated remote attacker can craft a malicious web request containing specially formatted path traversal sequences (../). Due to improper input sanitization, the application processes this input, allowing the attacker to read arbitrary files from the GitLab server's filesystem with the permissions of the GitLab service account. This could expose sensitive configuration files, credentials, and private SSH keys stored on the server.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.7, posing a significant risk to the organization. Exploitation could lead to a severe breach of confidentiality and integrity. Key business impacts include the theft of proprietary source code and intellectual property, exposure of developer credentials and API keys stored in repositories, and disruption of critical CI/CD pipelines, halting development and deployment operations. A successful attack could result in significant financial loss, reputational damage, and a complete compromise of the organization's software development infrastructure.

Remediation Plan

Immediate Action: Apply the security updates provided by GitLab immediately across all affected instances. Prioritize patching for internet-facing GitLab servers. After patching, continue to monitor for any signs of exploitation attempts by reviewing access logs for anomalous activity that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor web server and application logs for suspicious patterns. Look for unusual requests to repository import endpoints, especially those containing URL-encoded path traversal sequences (e.g., %2e%2e%2f). Monitor for unexpected outbound network connections from the GitLab server and any unusual processes spawned by the git user, which could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement compensating controls as a temporary measure. Restrict network access to the GitLab instance to only trusted IP addresses using a perimeter firewall. Deploy a Web Application Firewall (WAF) with rules designed to detect and block path traversal attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, given the critical nature of the flaw and the widespread deployment of GitLab, it is highly probable that security researchers and threat actors will develop a functional exploit in the near future.

Analyst Recommendation

This vulnerability represents a critical threat to organizations utilizing GitLab. Given the high CVSS score of 8.7 and the potential for complete system compromise, immediate action is required. Although this CVE is not currently listed on the CISA KEV list, its severity dictates that it should be treated with the highest priority. We strongly recommend that all organizations apply the vendor-supplied patches immediately. For internet-facing instances, patching should be considered an emergency change and implemented without delay.

---METADATA---
VENDOR: PublicCMS
PRODUCT: PublicCMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
PublicCMS v5 is affected by a high-severity security vulnerability that could lead to unauthorized system access or data compromise.

Executive Summary:
PublicCMS v5 contains a critical flaw that risks full application compromise, potentially allowing attackers to gain unauthorized control over the CMS environment.

Vulnerability Details

CVE-ID: CVE-2025-69437

Affected Software: PublicCMS PublicCMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within PublicCMS v5. Given the CVSS score of 8.7, this flaw likely involves a significant failure in access control or input validation, potentially allowing an attacker to bypass security mechanisms without requiring high-level administrative credentials.

Business Impact

The exploitation of this vulnerability could result in the loss of sensitive data, unauthorized modification of website content, and significant reputational damage. The high CVSS score of 8.7 justifies an urgent response, as the flaw could lead to complete administrative takeover of the affected PublicCMS instance.

Remediation Plan

Immediate Action: Administrators should immediately upgrade to the most recent version of PublicCMS v5 that includes the necessary security fixes.

Proactive Monitoring: Monitor application access logs for suspicious administrative logins or unauthorized attempts to access the CMS backend.

Compensating Controls: Restrict access to the PublicCMS management interface to known IP addresses and utilize a WAF to filter malicious traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity of the flaw suggests that it will be a high-priority target for malicious actors once technical details become known.

Analyst Recommendation

Given the high CVSS score and the critical role of CMS platforms in business operations, this vulnerability must be addressed immediately. Organizations should apply the primary remediation update to eliminate the risk of unauthorized system access.

Executive Summary:
A high-severity vulnerability has been discovered in multiple products from the vendor Media, which could allow an unauthenticated attacker to gain unauthorized access to the system. Successful exploitation could lead to the exposure of sensitive configuration data and user information, potentially enabling further compromise of the network. Organizations are urged to apply the vendor-provided security updates immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-69415

Affected Software: Media Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability:
The vulnerability exists due to an improper access control mechanism within the Plex Media Server (PMS) software. A specific API endpoint fails to properly validate user authentication and authorization, allowing a remote, unauthenticated attacker to send a specially crafted HTTP request to bypass security controls. Successful exploitation grants the attacker access to sensitive server information, including configuration files, media library metadata, and potentially user authentication tokens, which could be leveraged to escalate privileges.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.1. Exploitation could lead to significant business consequences, including a breach of sensitive corporate or personal data stored on the media server. Unauthorized access to configuration files may expose credentials for other integrated systems, creating a pathway for lateral movement within the network. The potential for data exfiltration and account takeovers poses a direct risk to confidentiality and could result in reputational damage, regulatory fines, and a loss of customer trust.

Remediation Plan

Immediate Action:
Organizations must prioritize the deployment of security patches provided by the vendor across all affected systems. In addition to patching, system administrators should actively monitor for signs of exploitation by thoroughly reviewing system and application access logs for any unusual or unauthorized activity originating from untrusted sources.

Proactive Monitoring:
Security teams should configure monitoring and alerting for anomalous HTTP requests targeting the affected server endpoints. Specifically, look for unusual traffic patterns or direct access attempts to administrative APIs from external, untrusted IP addresses. Review application logs for unauthorized access to media libraries or configuration settings that deviate from established baselines.

Compensating Controls:
If immediate patching is not feasible, restrict network access to the affected media servers. Ensure the server is placed behind a firewall and that access is limited to trusted, internal IP addresses only. Consider implementing a Web Application Firewall (WAF) with specific rules designed to inspect and block malicious requests targeting the vulnerable API endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes:
As of January 4, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and the unauthenticated nature of the attack vector, it is highly probable that security researchers and threat actors will develop proof-of-concept code in the near future.

Analyst Recommendation
This is a high-severity vulnerability that permits a remote, unauthenticated attacker to access sensitive information. Due to the CVSS score of 7.1 and the critical nature of the flaw, immediate patching is strongly recommended. Although this vulnerability is not currently listed on the CISA KEV catalog, its severity warrants urgent attention. Organizations should treat this as a critical priority and apply the vendor-supplied patches without delay to prevent potential exploitation and protect sensitive corporate and user data.

Executive Summary:
A high-severity vulnerability has been identified in Plex Media Server, designated as CVE-2025-69414 with a CVSS score of 8.5. This flaw could allow a remote, unauthenticated attacker to execute arbitrary code on the server, potentially leading to a complete system compromise. Successful exploitation could result in unauthorized access to sensitive media, service disruption, and the server being used to launch further attacks against the internal network.

Vulnerability Details

CVE-ID: CVE-2025-69414

Affected Software: Plex Media Server (PMS)

Affected Versions: Plex Media Server versions through 1.x. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability exists within the media parsing component of the Plex Media Server. A remote, unauthenticated attacker can send a specially crafted network request to the server, triggering a buffer overflow condition. This allows the attacker to execute arbitrary code on the underlying operating system with the same privileges as the Plex Media Server process, leading to a full compromise of the server.

Business Impact

This vulnerability presents a high risk to the organization, reflected by its CVSS score of 8.5. A successful exploit could lead to a complete loss of confidentiality, integrity, and availability for the affected server. Potential consequences include the theft or public exposure of sensitive corporate or personal media files, disruption of media services, and the compromised server being used as a pivot point to attack other critical systems on the corporate network. This could result in significant data breaches, operational downtime, and reputational damage.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor immediately to all affected Plex Media Server instances. After patching, review server access and application logs for any unusual activity or connections that may indicate a prior compromise.

Proactive Monitoring: Implement enhanced monitoring of network traffic to and from the Plex Media Server, specifically looking for unusual inbound connection patterns or outbound connections to unknown destinations. Monitor the server for unexpected processes being spawned by the Plex Media Server service or high CPU/memory usage that could indicate malicious activity.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Plex Media Server to only trusted IP addresses and subnets using a host-based or network firewall. Ensure the server is not directly exposed to the internet. Run the Plex Media Server process with the lowest possible user privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of January 3, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and the potential for unauthenticated remote code execution, it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation
Given the high-severity CVSS score of 8.5, this vulnerability requires immediate attention. Organizations must prioritize the deployment of the vendor-supplied patches to all affected systems. Although this vulnerability is not currently listed in the CISA KEV catalog, its critical nature makes it a prime target for future exploitation. If patching is delayed for any reason, the compensating controls outlined above must be implemented as an urgent interim measure to reduce the attack surface.

Executive Summary:
A high-severity vulnerability has been identified in multiple VanKarWai Calafate products, assigned CVE-2025-69342. This flaw allows an unauthenticated, remote attacker to trick the application into reading and displaying the contents of sensitive files on the server. Successful exploitation could lead to the exposure of confidential data, such as configuration files, source code, and system credentials, posing a significant risk to data privacy and system integrity.

Vulnerability Details

CVE-ID: CVE-2025-69342

Affected Software: VanKarWai Calafate Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Local File Inclusion (LFI) flaw resulting from improper input validation. The application uses a PHP include or require statement with user-supplied data without properly sanitizing it. An attacker can exploit this by crafting a malicious request containing directory traversal sequences (e.g., ../) to navigate the server's file system and access files outside of the intended web root directory. This could allow the attacker to read sensitive system files, application source code, or configuration files containing credentials.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could lead to a significant data breach by exposing sensitive information stored on the server, including customer data, intellectual property, and system credentials. The disclosure of such information can result in financial loss, reputational damage, regulatory penalties, and provide attackers with the necessary information to conduct further, more severe attacks against the organization's infrastructure.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by VanKarWai Calafate to all affected systems immediately. After patching, it is critical to review web server and application access logs for any signs of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor web server logs for requests containing directory traversal patterns such as ../, ..%2f, %2e%2e/, and other variants targeting the affected application endpoints. Implement file integrity monitoring on critical system and application files to detect unauthorized access or changes.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block directory traversal attack patterns. Additionally, enforce strict file permissions on the web server to limit the web process user's access to files outside of the web root directory, minimizing the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 7, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, Local File Inclusion vulnerabilities are well-understood and straightforward to exploit. It is highly probable that proof-of-concept (PoC) exploit code will be developed and released by security researchers or malicious actors in the near future.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the significant risk of sensitive data exposure, we strongly recommend that organizations prioritize the immediate application of the vendor-supplied patches. Although this vulnerability is not currently listed on the CISA KEV list, its potential impact warrants urgent attention. Organizations should treat this as a critical vulnerability and proceed with the remediation plan to mitigate the risk of a data breach.

Executive Summary: A critical privilege escalation vulnerability in The Opal Estate Pro WordPress plugin allows an authenticated attacker to gain full administrative control, leading to a complete compromise of the affected website.

Vulnerability Details

CVE-ID: CVE-2025-6934

Affected Software: The Opal Estate Pro – Property Management and Submission plugin

Affected Versions: All versions are considered vulnerable prior to the patched release.

Vulnerability: The plugin is susceptible to a privilege escalation flaw. An authenticated attacker with low-level permissions can exploit this vulnerability to elevate their privileges to that of an administrator, bypassing normal security restrictions.

Business Impact

A successful exploit would grant an attacker complete control over the affected WordPress site. This could lead to website defacement, theft of sensitive user data, injection of malware, or a complete denial of service. The assigned CVSS score of 9.8 (Critical) reflects the ease of exploitation and the total loss of confidentiality, integrity, and availability that would result from a compromise.

Remediation Plan

Immediate Action: Administrators must immediately update The Opal Estate Pro plugin to the latest version provided by the vendor to patch this vulnerability.

Proactive Monitoring: Review server and application access logs for any unauthorized or unexpected administrative actions, particularly user role changes or plugin modifications.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with rules designed to detect and block attempts to exploit privilege escalation vulnerabilities as a temporary mitigation.

Exploitation Status

Public Exploit Available: Not specified in provided data.

Analyst Notes: As of Jul 1, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the flaw, the potential for exploitation is extremely high once a proof-of-concept is developed.

Analyst Recommendation

Given the critical severity of this vulnerability, we strongly recommend that all administrators using this plugin apply the required update as an immediate priority. Delaying this action leaves the web application exposed to a full takeover by a low-privileged attacker. A full review of user accounts and site integrity is advised after patching.

---METADATA---
VENDOR: don-themes
PRODUCT: Riode Core
AFFECTED_VERSIONS: Versions <= 1.6.26
---END_METADATA---

Description Summary:
The Riode Core plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements, affecting versions up to 1.6.26.

Executive Summary:
A Blind SQL Injection vulnerability in the Riode Core plugin allows unauthenticated attackers to query the underlying database and potentially exfiltrate sensitive site information.

Vulnerability Details

CVE-ID: CVE-2025-69338

Affected Software: don-themes Riode Core

Affected Versions: Versions <= 1.6.26

Vulnerability: The vulnerability is caused by the improper neutralization of special elements used in SQL commands within the Riode Core plugin. This allows an attacker to perform Blind SQL Injection, where they can infer data from the database based on the application's response patterns to malicious queries.

Business Impact

Exploitation of this vulnerability can lead to the theft of sensitive information, including user credentials, site configurations, and customer data. Given the CVSS score of 9.3, this vulnerability represents a high risk to confidentiality and integrity, potentially leading to full site takeover if administrative credentials are recovered.

Remediation Plan

Immediate Action: Update the Riode Core plugin to the latest available version (greater than 1.6.26) via the WordPress dashboard or manual upload.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as repeated SLEEP() commands or complex conditional queries typical of Blind SQLi.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common SQL injection payloads and ensure the database user has restricted permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most common vectors for WordPress site compromises, and the "Blind" nature of this flaw makes it detectable but difficult to prevent without proper patching.

Analyst Recommendation

Administrators using the Riode Core plugin should treat this as a high-priority update. SQL injection vulnerabilities in core theme components are frequently exploited by automated botnets. Immediate remediation via patching is the only effective way to secure the database layer.

Executive Summary:
A critical remote code execution vulnerability has been discovered in the Titra project time tracking software. This flaw allows an authenticated administrator to execute arbitrary code on the server by manipulating a specific database value, potentially leading to a complete system compromise, data theft, or further network intrusion. Organizations using affected versions of Titra are at high risk and should take immediate action to mitigate this threat.

Vulnerability Details

CVE-ID: CVE-2025-69288

Affected Software: Titra is open source project time tracking Multiple Products

Affected Versions: All versions prior to 0.99.49

Vulnerability: The vulnerability exists because the application fails to properly sanitize user-supplied input for the timeEntryRule setting. An authenticated user with administrative privileges can modify this value in the database. The application subsequently passes this unsanitized value directly to a NodeVM instance for execution, allowing the attacker to inject and execute arbitrary server-side JavaScript code. This results in a full Remote Code Execution (RCE) on the underlying server, granting the attacker the same level of permissions as the application's user account.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.1, indicating a high risk to the organization. Successful exploitation could lead to a complete compromise of the server hosting the Titra application. An attacker could exfiltrate sensitive project data, user credentials, and other confidential information, install malware or ransomware, disrupt business operations by taking the service offline, or use the compromised server as a pivot point to attack other systems within the internal network. The potential for data breaches and significant operational downtime poses a severe threat to business continuity and reputation.

Remediation Plan

Immediate Action: Organizations must immediately upgrade all vulnerable instances of Titra to version 0.99.49 or later, as this version contains the necessary fix. After patching, it is crucial to review access logs for any unusual administrative activity or modifications to the timeEntryRule setting that occurred prior to the update to identify potential signs of a prior compromise.

Proactive Monitoring:

• Log Analysis: Scrutinize application and database logs for any modifications to the timeEntryRule configuration. Monitor for administrator logins from unexpected IP addresses or at unusual times.
• Network Monitoring: Monitor for unusual outbound network connections from the Titra server, which could indicate command-and-control communication or data exfiltration.
• Host-Based Monitoring: Implement file integrity monitoring and watch for the creation of unexpected processes, files, or scheduled tasks on the server, especially those originating from the Titra application process.

Compensating Controls:
If patching cannot be performed immediately, the following controls can help reduce risk:

• Strictly limit administrative access to the Titra application to a small number of trusted users and source IP addresses.
• Implement a Web Application Firewall (WAF) with rules designed to detect and block malicious payloads targeting the timeEntryRule parameter.
• Enhance segregation of the Titra server from the rest of the corporate network to limit the potential for lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of December 31, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, the attack vector is straightforward for an attacker who has already obtained administrative credentials through other means, such as phishing or credential stuffing. This makes it a high-value target for post-compromise activity.

Analyst Recommendation

Given the critical severity (CVSS 9.1) and the potential for complete system compromise, immediate remediation is strongly recommended. Although this vulnerability requires administrative credentials to exploit, the risk of insider threat or exploitation following a separate credential compromise is significant. Organizations must prioritize applying the patch to all affected Titra instances to prevent potential data breaches, operational disruption, and further network intrusion. While not currently listed on the CISA KEV catalog, its high severity warrants urgent attention.