---METADATA---
VENDOR: ZenTao
PRODUCT: ZenTaoPMS
AFFECTED_VERSIONS: v18.11 through v21.6.beta
---END_METADATA---

Description Summary:
ZenTaoPMS is vulnerable to a directory traversal flaw in its AI module, enabling unauthenticated attackers to achieve remote code execution via malicious file uploads.

Executive Summary:
A critical directory traversal vulnerability in ZenTaoPMS allows unauthenticated attackers to execute arbitrary code on the server through a crafted file upload.

Vulnerability Details

CVE-ID: CVE-2025-50857

Affected Software: ZenTao ZenTaoPMS

Affected Versions: v18.11 through v21.6.beta

Vulnerability: The vulnerability is located in the /module/ai/control.php component. It allows for directory traversal, which an unauthenticated attacker can leverage to upload and execute arbitrary files, leading to full system compromise.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a maximum-severity risk. A successful exploit allows for Remote Code Execution (RCE), giving attackers full access to the server, sensitive project management data, and the ability to pivot into the internal network.

Remediation Plan

Immediate Action: Update ZenTaoPMS to the latest stable version that addresses the directory traversal flaw in the AI module.

Proactive Monitoring: Scan the web server for unauthorized PHP files or shells, particularly in the /module/ai/ directory and temporary upload folders.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules to block directory traversal patterns (e.g., ../) and restrict file upload types at the server level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in project management software are frequently targeted by ransomware groups and state-sponsored actors.

Analyst Recommendation

Due to the potential for unauthenticated Remote Code Execution, this vulnerability must be addressed with the highest priority. Apply the vendor-provided security patches immediately to mitigate the risk of a complete server takeover.

Executive Summary:
A critical command injection vulnerability has been identified in multiple Wavlink products, assigned CVE-2025-50756 with a CVSS score of 9.8. This flaw allows an unauthenticated attacker to execute arbitrary commands on the affected device by sending a specially crafted request to change the administrator password. Successful exploitation results in a complete compromise of the router, enabling attackers to steal data, attack other devices on the network, or disrupt internet access.

Vulnerability Details

CVE-ID: CVE-2025-50756

Affected Software: Wavlink Multiple Products

Affected Versions: The specific version WN535K3 firmware 20191010 is confirmed vulnerable. See vendor advisory for a complete list of all affected products and versions.

Vulnerability: This vulnerability is a command injection flaw within the web administration interface. The set_sys_adm function, which is responsible for updating the administrator's credentials, fails to properly sanitize user-supplied input for the newpass parameter. An attacker can embed operating system commands within this parameter, which are then executed directly by the system shell with root privileges, leading to a full device takeover.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation allows an attacker to gain complete administrative control over the affected network device. The potential business impact is severe and includes theft of sensitive data transiting the network (e.g., credentials, financial data), using the compromised device as a pivot point to attack internal network assets, installation of persistent backdoors or ransomware, and inclusion of the device in a botnet for use in Distributed Denial-of-Service (DDoS) attacks. The reputational damage and operational disruption from such a compromise would be significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security patches provided by the vendor. Organizations must identify all vulnerable Wavlink devices in their environment and update the firmware to the latest version immediately. After patching, review device access logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on network devices. Specifically, monitor web server logs for POST requests to the device's administration panel, inspecting the newpass parameter for shell metacharacters (e.g., ;, |, &, $(), `). Monitor for unusual outbound traffic from the routers, which could indicate communication with a command-and-control (C2) server.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Disable remote (WAN) management of the router's administration interface.
• Restrict access to the administration interface to a dedicated and trusted management network segment.
• If a Web Application Firewall (WAF) is available, configure rules to inspect and block malicious payloads targeting this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 14, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and the simplicity of exploitation, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Due to the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that organizations prioritize patching all affected Wavlink devices immediately. The risk of complete network compromise is high. While there is no current evidence of active exploitation, vulnerabilities of this nature are prime targets for weaponization. If patching is delayed for any reason, the compensating controls listed above must be implemented as an urgent interim measure to mitigate risk.

---METADATA---
VENDOR: Unisite
PRODUCT: CMS
AFFECTED_VERSIONS: 5.0
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability within the "Report" functionality, allowing malicious scripts to execute in the admin panel.

Executive Summary:
A stored XSS vulnerability in Unisite CMS 5.0 allows attackers to execute malicious scripts within the context of an administrator's browser session.

Vulnerability Details

CVE-ID: CVE-2025-50754

Affected Software: Unisite CMS

Affected Versions: 5.0

Vulnerability: The application fails to properly sanitize input within the "Report" functionality, allowing an attacker to inject stored malicious scripts. When an administrator views the report, the script executes, potentially leading to session hijacking or unauthorized administrative actions.

Business Impact

This vulnerability poses a significant risk as it targets the administrative interface. A successful exploit could allow an attacker to compromise administrative accounts, leading to unauthorized system configuration changes, data theft, or complete site takeover. The CVSS score of 9.6 reflects the ease and high impact of this attack vector.

Remediation Plan

Immediate Action: Upgrade to the latest version of Unisite CMS that addresses the improper input handling in the "Report" module.

Proactive Monitoring: Monitor admin activity logs for unusual script execution or unauthorized changes to site configurations.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 4, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for administrative account compromise, immediate remediation is required. Security teams should prioritize patching the CMS and auditing recent administrative logs for signs of malicious activity.

Executive Summary:
A high-severity vulnerability has been identified in multiple Mitrastar products, including the GPT-2741GNAC-N2 model. The flaw allows an attacker to bypass a restricted command shell via SSH access, potentially leading to a full takeover of the affected network device. Successful exploitation could enable an attacker to intercept network traffic, access internal networks, or disrupt services.

Vulnerability Details

CVE-ID: CVE-2025-50753

Affected Software: Mitrastar Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The affected Mitrastar devices provide SSH access that defaults to a restricted shell, which is intended to limit administrative capabilities. However, a vulnerability exists within this restricted environment that allows for a "shell escape." An attacker with SSH access, potentially using default or weak credentials, can execute a specific sequence of commands to break out of the restricted shell and gain privileged (root-level) access to the underlying operating system of the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.4. A successful exploit would grant an attacker complete control over the compromised network device. This could lead to severe consequences, including man-in-the-middle attacks to eavesdrop on network traffic, unauthorized access to sensitive internal network segments, deployment of malware, or using the device as a pivot point for further attacks. The potential for data breaches, operational disruption, and reputational damage is significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by Mitrastar to all affected devices immediately. Patching this vulnerability is the most effective way to mitigate the risk.

Proactive Monitoring: Security teams should actively monitor for signs of compromise. This includes reviewing SSH access logs for unauthorized or suspicious login attempts, especially from external IP addresses. Monitor network traffic for unusual outbound connections from the Mitrastar devices, which could indicate a successful compromise and communication with a command-and-control server.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce the attack surface:

• Use a firewall or Access Control Lists (ACLs) to restrict SSH access to the devices from only trusted IP addresses or dedicated management networks.
• If SSH access is not essential for business operations, disable the service entirely on the devices.
• Ensure all default credentials have been changed to strong, unique passwords.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 27, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high CVSS score and the straightforward nature of shell escape vulnerabilities, it is highly likely that proof-of-concept exploits will be developed and published by security researchers or threat actors in the near future.

Analyst Recommendation

Given the high severity (CVSS 8.4) of this vulnerability and the risk of complete device compromise, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. Although this CVE is not currently listed on the CISA KEV catalog, its high impact makes it a prime candidate for future inclusion. Until patches are fully deployed, organizations must implement the suggested compensating controls, such as restricting SSH access, to mitigate immediate risk.

Executive Summary:
A critical vulnerability exists in The Memos application that allows an attacker to force the server to make requests to arbitrary URLs. By embedding a malicious image link in a memo, an attacker can scan an organization's internal network, access internal services, and potentially steal sensitive data or credentials. This vulnerability represents a significant risk of internal system compromise and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-50738

Affected Software: The Memos Multiple Products

Affected Versions: All versions up to and including v0.24.3

Vulnerability:
The vulnerability is a Server-Side Request Forgery (SSRF). The Memos application fails to properly validate the URLs provided within markdown for embedding images. An attacker with the ability to create or edit a memo can insert a markdown image tag pointing to an internal network address (e.g., http://192.168.1.100/dashboard, http://169.254.169.254/latest/meta-data). When any user views this memo, the application server, not the user's browser, fetches the content from the malicious URL. This allows the attacker to use the Memos server as a proxy to interact with services on the internal network that are not exposed to the internet, including internal APIs, admin panels, and cloud provider metadata services.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, posing a direct and severe threat to the organization. Exploitation can lead to a complete compromise of confidentiality and integrity of data accessible by the Memos server. Potential consequences include the exfiltration of sensitive corporate data, theft of cloud infrastructure credentials (e.g., AWS IAM roles), and providing an attacker with a pivot point to launch further attacks against other systems within the internal network. A successful exploit could result in a major data breach, significant financial loss, and severe reputational damage.

Remediation Plan

Immediate Action:
Immediately update all instances of The Memos to a version later than v0.24.3, as this is the primary remediation step recommended by the vendor. After patching, monitor application and network logs for any signs of exploitation that may have occurred prior to the update. Review access logs to identify any unusual memo creation or viewing activity.

Proactive Monitoring:
Monitor outbound network traffic from the server(s) hosting The Memos application. Specifically, look for HTTP/HTTPS requests originating from the server to internal IP address ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to known cloud metadata endpoints (e.g., 169.254.169.254). Alert on any such traffic, as it is a strong indicator of an exploitation attempt.

Compensating Controls:
If patching cannot be performed immediately, implement strict network egress filtering as a temporary measure. Configure firewall rules to block all outbound connections from the Memos server to internal network destinations and cloud metadata services. Only allow outbound traffic to known, required external domains. A Web Application Firewall (WAF) with rules to detect and block common SSRF patterns can also provide an additional layer of defense.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of Jul 29, 2025, there are no known public exploits for this vulnerability. However, because SSRF vulnerabilities in markdown processors are well understood, a functional exploit can be developed with minimal effort. Organizations should assume that attackers will begin targeting this vulnerability immediately following its public disclosure and act accordingly.

Analyst Recommendation
Given the critical 9.8 CVSS score and the direct path to internal network compromise, this vulnerability requires immediate attention. We strongly recommend that all organizations patch affected instances of The Memos without delay. Although this CVE is not currently on the CISA KEV list, its severity makes it a high-priority candidate for patching. If patching is delayed for any reason, the compensating controls, especially egress filtering, must be implemented as an urgent priority to mitigate the risk of a breach.

Executive Summary:
A high-severity directory traversal vulnerability, identified as CVE-2025-50735, has been discovered in multiple NextChat thru products. This flaw could allow a remote, unauthenticated attacker to bypass security restrictions and access sensitive files on the underlying server. Successful exploitation could lead to the exposure of confidential data, system credentials, or other critical information, posing a significant risk to the organization's security and data integrity.

Vulnerability Details

CVE-ID: CVE-2025-50735

Affected Software: NextChat thru Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a directory traversal (also known as path traversal) vulnerability. It exists because the application fails to properly sanitize user-supplied input for file or directory paths. A remote, unauthenticated attacker can exploit this by sending a specially crafted request containing "dot-dot-slash" (../) sequences to an exposed application endpoint. This manipulation tricks the application into navigating outside of the intended web root directory, allowing the attacker to read, and potentially write or delete, arbitrary files on the server's file system with the permissions of the web server user.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a significant negative impact on the business. An attacker could access confidential data, including customer information, intellectual property, application source code, and configuration files containing database credentials or API keys. This could lead to a major data breach, resulting in severe reputational damage, regulatory fines, and loss of customer trust. Furthermore, if the vulnerability allows file modification, an attacker could deface the website, plant a backdoor for persistent access, or cause a denial-of-service condition by deleting critical system files.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all affected systems. After patching, monitor for any signs of exploitation attempts by reviewing web server and application access logs for suspicious patterns indicative of directory traversal attacks.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. Review web server access logs for requests containing directory traversal sequences such as ../, ..%2f, or ..%5c. Configure Intrusion Detection/Prevention Systems (IDS/IPS) to alert on and block known directory traversal attack signatures. Implement File Integrity Monitoring (FIM) on critical server files to detect any unauthorized modifications.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) and enable rules designed to detect and block directory traversal attacks. Additionally, harden file system permissions to ensure the web server's service account has read/write access only to the directories it absolutely requires, restricting its ability to access sensitive system-level files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 3, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, directory traversal is a well-understood vulnerability class, and threat actors can develop exploits for such flaws relatively quickly after a public disclosure.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and its potential for enabling unauthorized access to sensitive data, we strongly recommend that organizations prioritize the immediate application of the vendor-supplied security patches. Although this CVE is not currently listed on the CISA KEV list, its impact warrants urgent attention. All internet-facing instances of affected NextChat thru products should be considered at high risk. If immediate patching is not feasible, the compensating controls outlined above, particularly the use of a WAF, should be implemented as a temporary mitigation.

Executive Summary:
A critical vulnerability, identified as CVE-2025-50722, has been discovered in the sparkshop application, carrying a CVSS score of 9.8. This flaw stems from insecure file permissions, which could allow a remote, unauthenticated attacker to execute arbitrary code and gain complete control over the affected server. Successful exploitation could lead to total system compromise, data theft, and significant service disruption.

Vulnerability Details

CVE-ID: CVE-2025-50722

Affected Software: sparkshop

Affected Versions: Version 1.1.7 is confirmed to be vulnerable. See vendor advisory for a complete list of affected versions and products.

Vulnerability: The vulnerability is an insecure permissions flaw within the Common.php component of the sparkshop application. The file permissions may allow the web server process to write to this file, a function that should be read-only. A remote attacker could exploit this by crafting a request that overwrites the contents of Common.php with malicious PHP code. When the application subsequently includes or executes this modified file, the attacker's code will run on the server with the privileges of the web server user, resulting in remote code execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit grants an attacker complete control over the application server, posing an extreme risk to the organization. Potential consequences include the theft of sensitive data such as customer information and payment details, deployment of ransomware, disruption of business operations, and reputational damage. The compromised server could also be used as a pivot point to launch further attacks against the internal network, escalating the security incident significantly.

Remediation Plan

Immediate Action: Organizations must immediately update all vulnerable instances of sparkshop to the latest patched version as recommended by the vendor. After patching, it is crucial to monitor systems for any signs of compromise that may have occurred prior to remediation by reviewing access logs for unusual activity related to the Common.php file.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes scrutinizing web server logs for unusual POST requests or attempts to modify application files. Implement file integrity monitoring (FIM) to generate alerts on any unauthorized changes to Common.php or other core application files. Monitor for anomalous outbound network traffic from the web server, which could indicate a successful compromise and communication with a command-and-control server.

Compensating Controls: If immediate patching is not feasible, apply the following compensating controls:

• Modify the file system permissions for Common.php and other critical application files to be read-only for the web server user.
• Deploy a Web Application Firewall (WAF) with rules designed to block requests attempting to write to PHP files or exploit this specific vulnerability.
• Enhance network segmentation to isolate the affected server, limiting an attacker's ability to move laterally within the network if the system is compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 25, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity (CVSS 9.8) and the relative simplicity of exploiting insecure file permissions for RCE, it is highly probable that a functional exploit will be developed and released by threat actors in the near future.

Analyst Recommendation

Given the critical severity of CVE-2025-50722, we strongly recommend that organizations treat this as an emergency and apply the vendor-supplied patch to all affected sparkshop instances immediately. The potential for complete system compromise represents an unacceptable risk. While this vulnerability is not currently listed on the CISA KEV list, its high-impact nature makes it a prime candidate for future inclusion. Prioritize patching and implement the recommended monitoring and compensating controls without delay.

Executive Summary:
A critical remote code execution (RCE) vulnerability has been identified in a specific version of the ThinkPHP framework, a popular web application development platform. This flaw allows a remote, unauthenticated attacker to execute arbitrary commands on the server by sending a specially crafted request, potentially leading to a complete system compromise, data theft, and service disruption. Due to the ease of exploitation and the severity of the impact, this vulnerability poses a significant and immediate risk to affected organizations.

Vulnerability Details

CVE-ID: CVE-2025-50707

Affected Software: ThinkPHP

Affected Versions: ThinkPHP v.3.2.5

Vulnerability: The vulnerability exists due to improper input sanitization within the URL routing mechanism handled by the index.php component. A remote attacker can construct a malicious URL that bypasses security validations and manipulates the application's controller and action parameters. This allows the attacker to call arbitrary system functions, resulting in remote code execution on the server with the permissions of the web service account.

Business Impact

This vulnerability is rated as Critical with a CVSS score of 9.8, signifying a high risk to the business. Successful exploitation grants an attacker complete control over the affected web application and underlying server. This could lead to severe consequences, including the theft of sensitive data (customer information, intellectual property, financial records), defacement of the website, complete service outages, or the use of the compromised server as a pivot point to attack other systems on the internal network. The potential for significant financial loss, regulatory fines, and reputational damage is extremely high.

Remediation Plan

Immediate Action: Update the affected ThinkPHP framework to the latest secure version provided by the vendor. After patching, it is crucial to monitor for any signs of post-compromise activity and review historical access logs for indicators of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Implement enhanced monitoring on affected web servers. Security teams should look for suspicious GET or POST requests to index.php containing unusual or obfuscated strings in the URL parameters. Monitor for unexpected processes being spawned by the web server user (e.g., www-data, apache) and any anomalous outbound network connections from the web server.

Compensating Controls: If patching cannot be immediately deployed, implement a Web Application Firewall (WAF) with rules specifically designed to block the malicious request patterns associated with this vulnerability. Additionally, ensure the web server operates with the principle of least privilege and that the server is segmented from critical internal network resources to limit the potential blast radius of a compromise.

Exploitation Status

Public Exploit Available: False (as of Aug 5, 2025)

Analyst Notes: As of the publication date, there is no known public exploit code available for this vulnerability. However, due to the critical nature of remote code execution flaws in widely used frameworks, it is highly probable that threat actors will reverse-engineer the patch and develop a functional exploit in the near future. Organizations should assume active exploitation is imminent.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the potential for a full system compromise, this vulnerability requires immediate attention. Although CVE-2025-50707 is not currently on the CISA Known Exploited Vulnerabilities (KEV) list, its high impact makes it an attractive target for attackers. We strongly recommend that organizations identify all instances of the vulnerable ThinkPHP version and apply the vendor-supplied patches as the highest priority. If patching is delayed, the compensating controls outlined above must be implemented immediately to reduce the risk of exploitation.

Executive Summary:
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-50706, has been discovered in the ThinkPHP framework. This flaw allows an unauthenticated remote attacker to take complete control of an affected web server by sending a specially crafted request. Successful exploitation could lead to total system compromise, data theft, and significant service disruption.

Vulnerability Details

CVE-ID: CVE-2025-50706

Affected Software: ThinkPHP

Affected Versions: Version 5.1 is explicitly mentioned. See vendor advisory for a complete list of affected versions and products.

Vulnerability: The vulnerability exists within the routecheck function of the ThinkPHP framework. Due to improper input validation, an attacker can craft a malicious URL or request payload that is not correctly sanitized by the routing mechanism. This allows the injection and execution of arbitrary PHP code on the underlying server, operating with the permissions of the web server process.

Business Impact

This vulnerability is rated as Critical with a CVSS score of 9.8. Exploitation can lead to a complete compromise of the affected web application and server. The potential business impact includes theft of sensitive data such as customer information or intellectual property, website defacement, service outages, and the use of the compromised server to launch further attacks against the internal network. Such an incident could result in severe reputational damage, financial loss, and potential regulatory penalties.

Remediation Plan

Immediate Action: The primary remediation is to update all affected ThinkPHP instances to the latest secure version as recommended by the vendor. After patching, it is crucial to review web server access logs and application logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes analyzing web server logs for unusual or malformed requests targeting the application's routing endpoints. Monitor system processes for unexpected command execution by the web server user and scrutinize outbound network traffic for connections to unknown or suspicious destinations.

Compensating Controls: If immediate patching is not feasible, organizations should implement a Web Application Firewall (WAF) with virtual patching rules designed to block known exploit patterns for this CVE. Additionally, ensure the web server runs with the lowest possible privileges and consider network segmentation to limit an attacker's ability to move laterally if the server is compromised.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Aug 5, 2025, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity, the popularity of the ThinkPHP framework, and the availability of public proof-of-concept exploit code, active exploitation by threat actors is highly likely and should be assumed.

Analyst Recommendation

Due to the critical nature (CVSS 9.8) and the high likelihood of active exploitation, this vulnerability poses a severe and immediate risk to the organization. We strongly recommend that all systems running the affected ThinkPHP versions be patched immediately. If patching cannot be performed right away, apply the suggested compensating controls, particularly WAF rules, as a temporary measure. This vulnerability should be treated with the highest priority, equivalent to those on the CISA KEV list.

Executive Summary:
A high-severity vulnerability has been discovered in multiple versions of igmpproxy, a widely used multicast routing daemon. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted network packet, causing the service to crash and resulting in a denial-of-service condition. This can disrupt critical network services that rely on multicast traffic, such as IPTV and real-time data streaming.

Vulnerability Details

CVE-ID: CVE-2025-50681

Affected Software: igmpproxy Multiple Products

Affected Versions: See vendor advisory for specific affected versions. All versions prior to 0.4 are believed to be vulnerable.

Vulnerability: The vulnerability is a heap-based buffer overflow within the IGMP (Internet Group Management Protocol) packet parsing function of the igmpproxy daemon. An attacker can send a malformed IGMP packet to a vulnerable device, which the daemon fails to validate correctly. This leads to writing data beyond the allocated buffer, corrupting memory and causing the igmpproxy process to terminate, resulting in a denial-of-service. Exploitation requires no authentication and can be performed remotely by any attacker with network access to the affected service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation would lead to a denial-of-service, directly impacting the availability of services dependent on multicast routing. For organizations using igmpproxy to facilitate services like IPTV, video conferencing, financial market data feeds, or other real-time streaming applications, an outage could result in significant business disruption, financial loss, and reputational damage. The primary risk is an immediate and complete loss of multicast-dependent services until the igmpproxy daemon is manually restarted.

Remediation Plan

Immediate Action:

• Identify all network devices running a vulnerable version of the igmpproxy software.
• Apply the security updates or patches provided by the vendor immediately to remediate the vulnerability.
• After patching, reboot the service and confirm that it is operating correctly and the version has been successfully updated.

Proactive Monitoring:

• Monitor system logs for unexpected crashes or restarts of the igmpproxy process.
• Analyze network traffic for an unusual volume of IGMP packets or malformed packets targeting devices running igmpproxy.
• Implement alerts for service availability to detect outages of multicast-dependent applications promptly.

Compensating Controls:

• If immediate patching is not feasible, implement strict firewall rules to restrict access to the igmpproxy service from untrusted networks or unauthorized IP addresses.
• Deploy an Intrusion Prevention System (IPS) with signatures designed to detect and block attempts to exploit this specific vulnerability.
• Ensure the service is configured to restart automatically upon failure to minimize the duration of a potential outage.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 21, 2025, there are no known public exploits or active exploitation attempts in the wild. However, given the nature of the buffer overflow, it is anticipated that a functional proof-of-concept exploit for denial-of-service could be developed with minimal effort by security researchers or threat actors.

Analyst Recommendation

Due to the high severity (CVSS 7.5) and the critical role igmpproxy plays in maintaining multicast network services, immediate patching is strongly recommended. Although this vulnerability is not currently listed on the CISA KEV catalog and no active exploitation has been observed, the low complexity of a potential attack creates a significant risk of service disruption. Organizations should prioritize the deployment of vendor-supplied updates to all affected systems to prevent potential outages.

Executive Summary:
A high-severity vulnerability has been discovered in the password change functionality of multiple products from the vendor "issue." This flaw could allow an attacker to change user passwords without proper authorization, potentially leading to a complete system compromise by escalating privileges to an administrative level. Organizations are urged to apply the vendor-supplied security patches immediately to prevent unauthorized access and protect sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-50674

Affected Software: issue Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the changePassword method located in the /usr/share/php/openmediavault/system/user file. This function fails to properly validate or enforce authorization checks when a password change is requested. An authenticated attacker with low-level privileges could exploit this flaw by crafting a specific request to change the password of any other user on the system, including administrative accounts. Successful exploitation results in privilege escalation, granting the attacker unauthorized administrative control over the affected system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8, posing a significant risk to the organization. Successful exploitation could lead to a full system compromise, allowing an attacker to access, modify, or exfiltrate sensitive data, disrupt critical services, and install malicious software. The primary business risks include data breaches, loss of system integrity and confidentiality, operational downtime, and the potential for an attacker to use the compromised system as a pivot point for further attacks within the corporate network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to review system access logs for any unauthorized password changes or suspicious administrative logins that may have occurred prior to the patch application.

Proactive Monitoring: Implement enhanced monitoring of authentication and system logs. Specifically, look for multiple failed login attempts followed by a successful one from an unusual IP address, password change events for administrative accounts initiated by non-administrative users, and any unexpected commands being executed by the web server process.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls:

• Restrict network access to the device's management interface to a dedicated and trusted administrative network or specific IP addresses.
• Deploy a Web Application Firewall (WAF) with rulesets designed to inspect and block malicious requests targeting the password change endpoint.
• Enforce Multi-Factor Authentication (MFA) on all administrative accounts to provide an additional layer of security, mitigating the risk of a compromised password.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 22, 2025, there are no known public proof-of-concept exploits or observed in-the-wild attacks leveraging this vulnerability. However, due to the high severity and relative simplicity of exploitation, the likelihood of threat actor activity targeting this flaw is expected to increase rapidly.

Analyst Recommendation

Given the high CVSS score of 7.8 and the critical impact of privilege escalation, we strongly recommend that organizations prioritize patching this vulnerability immediately, starting with internet-facing systems. Although this CVE is not currently on the CISA KEV list, its severity makes it a prime target for future exploitation. Organizations should treat this as an urgent threat and apply all recommended remediation and monitoring actions without delay to prevent a potential system compromise.

Here is the professional vulnerability analysis report in the specified format.

Executive Summary:
A high-severity vulnerability exists within the WP Import Export Lite plugin for WordPress, allowing an attacker to upload malicious files to a target website. This flaw could be exploited to execute arbitrary code, potentially leading to a complete compromise of the website, data theft, and reputational damage.

Vulnerability Details

CVE-ID: CVE-2025-5061

Affected Software: WordPress WP Import Export Lite plugin

Affected Versions: All versions up to, and including, version 3.

Vulnerability: The vulnerability is an Arbitrary File Upload in the wpie_parse_upload_data function. This function lacks proper server-side validation to ensure that uploaded files are of an expected and safe file type (e.g., CSV, XML). An authenticated attacker with access to the plugin's import functionality can bypass client-side restrictions and upload a malicious script, such as a PHP web shell, disguised as a legitimate import file. Once the malicious file is on the server, the attacker can access it via its URL to execute code in the security context of the web server, leading to remote code execution (RCE).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could have a significant negative impact on the business. The primary risk is remote code execution, which can lead to a complete compromise of the web server. Potential consequences include the theft of sensitive data such as customer information or intellectual property, website defacement causing reputational harm, and financial losses from downtime or regulatory fines. A compromised server could also be used to attack other systems within the network or serve malware to visitors, further escalating the damage.

Remediation Plan

Immediate Action:

• Immediately update the WP Import Export Lite plugin to the latest version available from the vendor, which is confirmed to be patched against this vulnerability.
• If the plugin is not essential for business operations, the recommended course of action is to disable and completely uninstall it to eliminate the attack surface.
• Review WordPress user roles and permissions to ensure that only trusted users have the ability to upload files.

Proactive Monitoring:

• Log Analysis: Monitor web server access logs for suspicious POST requests to the plugin's upload endpoints. Scrutinize the WordPress uploads directory for any files with executable extensions (e.g., .php, .phtml, .php5).
• File Integrity Monitoring (FIM): Utilize a FIM solution to detect any unauthorized changes or additions to WordPress core, theme, and plugin files.
• Network Traffic Analysis: Monitor for any unusual outbound network connections from the web server, which could indicate a command-and-control (C2) channel established by an attacker.

Compensating Controls:

• Web Application Firewall (WAF): Implement a WAF with rules designed to block the upload of files with dangerous extensions and to filter malicious request patterns targeting the vulnerable plugin.
• Harden Server Permissions: Configure web server and file system permissions to prevent the execution of scripts from the uploads directory. For Apache, this can be achieved using an .htaccess file with rules to deny script execution.
• Plugin Deactivation: If patching cannot be performed immediately, disable the plugin until the update can be safely deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, arbitrary file upload vulnerabilities in widely used WordPress plugins are a common target for threat actors, and proof-of-concept exploits are often developed and published quickly following disclosure.

Analyst Recommendation

Given the high-severity rating (CVSS 7.5) and the risk of remote code execution, this vulnerability requires immediate attention. Although it is not currently listed in the CISA KEV catalog, its potential for complete system compromise presents a critical risk. It is strongly recommended that all organizations using the WP Import Export Lite plugin prioritize applying the vendor's patch immediately. If the plugin is not business-critical, it should be removed to mitigate this threat entirely.

Executive Summary:
A high-severity authentication bypass vulnerability has been identified in the Bravis User plugin for WordPress. This flaw allows an unauthenticated attacker to gain unauthorized access to the affected website, potentially with administrative privileges. Successful exploitation could lead to a complete compromise of the website, data theft, or further attacks launched from the compromised server.

Vulnerability Details

CVE-ID: CVE-2025-5060

Affected Software: WordPress Bravis User plugin

Affected Versions: All versions up to, and including, 1

Vulnerability: The Bravis User plugin contains an authentication bypass vulnerability. This flaw allows a remote, unauthenticated attacker to circumvent the standard login process by sending a specially crafted request to the target website. By exploiting this vulnerability, an attacker can gain access to an existing user's account, including administrative accounts, without needing to provide valid credentials, leading to a full compromise of the WordPress site.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. A successful exploit could have significant negative impacts on the business. An attacker with administrative access can deface the website, steal sensitive customer or user data, inject malicious code to attack site visitors, and use the server for malicious activities like hosting phishing pages or sending spam. Such an incident can lead to severe reputational damage, loss of customer trust, regulatory fines for data breaches, and significant financial costs for incident response and recovery.

Remediation Plan

Immediate Action: Immediately update the Bravis User plugin to the latest patched version provided by the developer. If the plugin is not essential to business operations, the recommended course of action is to deactivate and completely remove it to eliminate the attack surface. After applying the update, review all WordPress user accounts, especially those with administrative privileges, for any signs of unauthorized activity.

Proactive Monitoring: Monitor web server access logs and WordPress security logs for unusual login attempts or direct access to administrative pages from unknown IP addresses. Watch for the creation of new, unauthorized administrative accounts or unexpected modifications to website files, themes, or other plugins. An increase in requests to plugin-specific endpoints could indicate scanning or exploitation attempts.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) with virtual patching rules to block exploit attempts targeting this vulnerability. Restrict access to the WordPress administrative dashboard (/wp-admin/) to trusted IP addresses only. Enforce multi-factor authentication (MFA) for all users, as it may provide an additional layer of security against some exploitation methods.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 24, 2025, there is no known public proof-of-concept exploit code, and the vulnerability is not reported to be actively exploited in the wild. However, given the critical nature of authentication bypass vulnerabilities, threat actors are likely to develop exploits rapidly.

Analyst Recommendation
Due to the high severity (CVSS 8.1) of this vulnerability, we strongly recommend immediate action. The ability for an unauthenticated attacker to gain full administrative control presents a critical risk to the organization. All WordPress sites using the Bravis User plugin must be identified and patched immediately by updating to the latest version. If the plugin is non-essential, it should be removed as the most effective mitigation. Although this vulnerability is not currently on the CISA KEV list, its critical impact warrants urgent attention to prevent a potential website compromise.

---METADATA---
VENDOR: Danphe Health
PRODUCT: Hospital Management System EMR
AFFECTED_VERSIONS: 3.2
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A critical authentication vulnerability in the Danphe Health Hospital Management System EMR version 3.2 allows unauthorized attackers to reset user account passwords via the SecuritySettingsController.

Executive Summary:
A critical vulnerability in Danphe Health Hospital Management System EMR allows unauthorized attackers to reset any user account password, leading to complete account takeover.

Vulnerability Details

CVE-ID: CVE-2025-50594

Affected Software: Danphe Health Hospital Management System EMR

Affected Versions: 3.2

Vulnerability: The flaw resides in the SecuritySettingsController.cs file, which fails to properly validate requests, allowing an attacker to trigger a password reset for arbitrary accounts. This is a severe authentication/authorization flaw affecting the system's security settings.

Business Impact

With a CVSS score of 9.8, this vulnerability presents a catastrophic risk to the confidentiality and integrity of sensitive patient health information. Unauthorized password resets enable attackers to take over administrative or provider accounts, leading to potential data theft, unauthorized medical record modification, and severe regulatory non-compliance.

Remediation Plan

Immediate Action: Contact Danphe Health support immediately to obtain and apply the necessary security patch for version 3.2.

Proactive Monitoring: Audit user account changes and password reset logs for suspicious activity, particularly those occurring outside of standard administrative workflows.

Compensating Controls: Implement strict network-level access controls to the EMR system and restrict access to the affected controller endpoints if possible via a Web Application Firewall (WAF).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 13, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely high-risk vulnerability that directly threatens sensitive healthcare data. It is imperative that administrators coordinate with the vendor to deploy the patch immediately and conduct a thorough audit of account access logs to ensure no compromise has already occurred.

Executive Summary:
A critical vulnerability has been identified in a specific version of the LinuxServer.io heimdall application. This flaw allows an unauthenticated remote attacker to manipulate HTTP headers to potentially take control of the application, redirect users to malicious sites, or access sensitive information. Due to its critical severity and the ease of exploitation, this vulnerability poses a significant and immediate risk to the organization's security posture.

Vulnerability Details

CVE-ID: CVE-2025-50578

Affected Software: LinuxServer.io heimdall

Affected Versions: 2.6.3-ls307

Vulnerability: The vulnerability exists in the application's processing of user-supplied HTTP headers, specifically the X-Forwarded-Host and Referer headers. The application improperly trusts the values in these headers, which can be controlled by an attacker. A remote, unauthenticated attacker can craft a malicious HTTP request with a manipulated header value to trigger various attacks, such as web cache poisoning, password reset link poisoning, or Server-Side Request Forgery (SSRF), potentially leading to a full compromise of the application and the underlying server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high potential for severe business impact. Successful exploitation could grant an attacker complete control over the Heimdall application dashboard, which often serves as a central hub for accessing other critical internal applications and services. This could lead to the exposure of sensitive credentials, unauthorized access to internal systems, data breaches, and lateral movement within the network. The compromised server could also be used to launch further attacks, resulting in significant operational disruption and reputational damage.

Remediation Plan

Immediate Action: Immediately update all instances of LinuxServer.io heimdall to the latest version as recommended by the developer. After patching, review web server and application access logs for any signs of attempted or successful exploitation that may have occurred prior to the update.

Proactive Monitoring: Implement monitoring rules to detect and alert on suspicious web requests to the Heimdall application. Specifically, look for unusual or malformed values in the X-Forwarded-Host and Referer headers in web server logs (e.g., Nginx, Apache). Monitor for unexpected outbound network connections from the server hosting Heimdall, which could indicate a successful SSRF attack.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) to inspect, sanitize, and block malicious requests containing manipulated X-Forwarded-Host and Referer headers. Additionally, restrict network access to the Heimdall dashboard to only trusted IP addresses and networks to reduce the external attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 30, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical CVSS score and the unauthenticated nature of the vulnerability, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that immediate action be taken. All vulnerable instances of LinuxServer.io heimdall must be patched without delay. Although there is no evidence of active exploitation at this time, the risk of compromise is severe. Organizations should prioritize this update and implement the recommended compensating controls and proactive monitoring to defend against potential future attacks.

Executive Summary:
A critical vulnerability has been identified in the Saurus CMS Community Edition, assigned a maximum severity score of 10.0. This flaw allows an unauthenticated attacker to remotely execute arbitrary code on the server, leading to a complete system compromise. Organizations using the affected software are at immediate risk of data theft, service disruption, and full server takeover.

Vulnerability Details

CVE-ID: CVE-2025-50567

Affected Software: Saurus CMS Community Edition Multiple Products

Affected Versions: Version 4.7.1 and potentially prior versions. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability exists within the custom DB::prepare() function of the Saurus CMS application. This function utilizes the preg_replace() PHP function with the /e (PREG_REPLACE_EVAL) modifier, which has been deprecated due to its inherent security risks. The /e modifier instructs preg_replace() to treat the replacement string as PHP code and execute it. An attacker can craft a malicious input that, when processed by this function as a SQL query parameter, will be executed as code on the server, resulting in Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10, representing the highest possible risk. Successful exploitation would grant an attacker complete control over the web server hosting the Saurus CMS instance. The potential consequences include, but are not limited to, theft of all data stored in the CMS database (such as customer information, user credentials, and proprietary content), unauthorized modification of the website, service disruption, and using the compromised server to launch further attacks against the organization's internal network or external targets. This could lead to significant financial loss, regulatory penalties, and severe reputational damage.

Remediation Plan

Immediate Action: The most effective mitigation is to immediately apply the security updates provided by the vendor. Administrators must Update Saurus CMS Community Edition Multiple Products to the latest version to patch the vulnerable DB::prepare() function. Following the update, it is crucial to monitor for exploitation attempts and review access logs for any signs of compromise that may have occurred prior to patching.

Proactive Monitoring:

• Web Server Logs: Scrutinize web server (e.g., Apache, Nginx) access and error logs for unusual POST or GET requests. Look for requests containing PHP code, shell commands, or suspicious character sequences (e.g., eval(), system(), passthru()) within query parameters.
• File Integrity Monitoring (FIM): Implement FIM to detect unauthorized changes to core CMS files or the creation of new files (e.g., web shells) in web-accessible directories.
• Network Traffic: Monitor for anomalous outbound connections from the Saurus CMS server, which could indicate a successful compromise and communication with an attacker's command-and-control server.

Compensating Controls: If patching cannot be performed immediately, the following temporary controls can reduce the risk of exploitation:

• Web Application Firewall (WAF): Deploy a WAF with a strict ruleset designed to block common code injection and command injection attack patterns in web requests.
• Network Segmentation: Isolate the server hosting Saurus CMS from other critical internal systems to prevent lateral movement in the event of a compromise.
• Least Privilege: Ensure the web server's user account has the minimum permissions necessary to function, limiting an attacker's ability to impact the underlying operating system.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 19, 2025, there are no known public exploits for this vulnerability. However, the vulnerability stems from the use of a deprecated and notoriously insecure programming practice (preg_replace /e). This makes the vulnerability relatively straightforward to exploit by a skilled attacker, and it is highly likely that a functional exploit will be developed and released publicly in the near future. The CVSS score of 10 reflects that the vulnerability is remotely exploitable with low complexity and requires no user interaction.

Analyst Recommendation

Given the critical severity (CVSS 10) of this vulnerability and the high probability of exploit development, we strongly recommend that organizations treat this as an emergency. Immediate patching of all affected Saurus CMS instances is the highest priority. If patching is delayed for any reason, compensating controls, especially a properly configured Web Application Firewall, must be implemented without delay. Although this CVE is not currently on the CISA KEV catalog, its critical nature makes it a prime candidate for future inclusion, and organizations should act proactively to prevent a potential compromise.

---METADATA---
VENDOR: Netgear
PRODUCT: EX8000
AFFECTED_VERSIONS: V1.0.0.126
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Netgear EX8000 firmware version V1.0.0.126 contains a command injection vulnerability in the switch_status function that can lead to unauthorized code execution.

Executive Summary:
A critical command injection vulnerability in Netgear EX8000 firmware version V1.0.0.126 allows unauthenticated attackers to execute arbitrary commands on the device.

Vulnerability Details

CVE-ID: CVE-2025-50526

Affected Software: Netgear EX8000

Affected Versions: V1.0.0.126

Vulnerability: The vulnerability exists due to improper input sanitization within the switch_status function. An attacker can leverage this flaw to inject malicious system commands, which are then executed with elevated privileges on the underlying operating system.

Business Impact

Successful exploitation allows for complete takeover of the network device, which can be used as a foothold for lateral movement into the internal network. With a CVSS score of 9.8, this represents a critical risk to network integrity and confidentiality, potentially allowing attackers to intercept traffic or disable security controls.

Remediation Plan

Immediate Action: Update the firmware on the affected Netgear EX8000 device to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the device and audit system logs for unexpected command executions or configuration changes.

Compensating Controls: If a firmware update cannot be applied immediately, isolate the device from the public internet and restrict management interface access to trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 23, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Command injection vulnerabilities in network infrastructure are highly dangerous. Administrators should treat this as a high-priority update to prevent unauthorized control over the network edge and ensure the continued security of the local environment.

---METADATA---
VENDOR: libcoap
PRODUCT: libcoap
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the libcoap library's coap_delete_pdu_lkd function allows for improper memory handling of PDU objects.

Executive Summary:
A critical use-after-free vulnerability in the libcoap library could lead to application crashes or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-50518

Affected Software: libcoap libcoap

Affected Versions: See vendor advisory

Vulnerability: This is a memory management flaw occurring in the coap_delete_pdu_lkd function. Improper handling of PDU object memory after it has been freed creates a use-after-free condition, which can be triggered by specifically crafted network packets.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of remote code execution. Successful exploitation could allow an attacker to gain control over the affected system, resulting in total system compromise, unauthorized data access, or persistent service disruption.

Remediation Plan

Immediate Action: Upgrade to the latest version of the libcoap library containing the necessary memory management fixes.

Proactive Monitoring: Monitor system logs for memory access violations or unexpected process crashes that may indicate an exploitation attempt.

Compensating Controls: If immediate patching is not possible, implement network-level access controls to restrict traffic to the affected service, limiting the attack surface.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Aug 14, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The extreme severity of this use-after-free vulnerability requires an immediate update to the libcoap library. Security teams should prioritize patching this library across all environments to prevent potential remote exploitation of the underlying system.