Executive Summary:
A critical vulnerability has been identified in multiple JeeWMS products, designated as CVE-2025-50901 with a CVSS score of 9.8. This flaw allows an unauthenticated attacker to bypass security controls and read arbitrary files from the underlying server, potentially exposing sensitive data such as configuration files, credentials, and proprietary information. Due to its critical severity and the ease of exploitation, immediate remediation is strongly recommended to prevent a potential data breach.

Vulnerability Details

CVE-ID: CVE-2025-50901

Affected Software: JeeWMS Multiple Products

Affected Versions: Versions including and prior to commit 771e4f5d0c01ffdeae1671be4cf102b73a3fe644. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is an incorrect authentication bypass. A flaw in the application's authentication logic allows a remote, unauthenticated attacker to circumvent access controls. By exploiting this flaw, the attacker can then leverage a file reading function, likely through path traversal, to access and exfiltrate any file on the server's filesystem that the application's user account has permission to read. This could include sensitive application source code, configuration files containing database credentials, system files, and other confidential data.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. Successful exploitation could lead to a severe data breach, resulting in the compromise of sensitive corporate data, customer information (PII), and intellectual property. The exposure of credentials read from configuration files could allow an attacker to pivot and gain deeper access to the internal network, leading to a wider system compromise. Potential consequences include significant financial loss, reputational damage, regulatory penalties, and loss of customer trust.

Remediation Plan

Immediate Action: The highest priority is to apply the security patches provided by the vendor.

• Update all instances of JeeWMS Multiple Products to the latest, patched version immediately.
• After patching, review server access logs and application logs for any signs of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring:

• Implement enhanced monitoring of web server logs for suspicious requests, such as those containing directory traversal patterns (e.g., ../, ..%2f).
• Monitor for unusual outbound network traffic from the application servers, which could indicate data exfiltration.
• Audit file system access logs for unexpected read attempts by the JeeWMS service account, particularly on sensitive system or configuration files.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with strict rules to block path traversal and other common web attack patterns.
• Restrict network access to the affected application, allowing connections only from trusted IP addresses.
• Enforce the principle of least privilege by ensuring the service account running JeeWMS has the most restrictive file permissions possible, limiting its ability to read sensitive files outside of its application directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of this advisory (Aug 20, 2025), there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the critical severity (9.8) and the nature of the flaw (unauthenticated remote file read), it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical severity of CVE-2025-50901, this vulnerability requires immediate attention. The potential for a complete compromise of sensitive data by an unauthenticated attacker makes it a top-priority target for remediation. Although it is not currently listed on the CISA KEV catalog, its high-impact nature makes it a likely candidate for future inclusion. We strongly recommend that organizations apply the vendor-supplied updates to all affected JeeWMS products without delay to mitigate this significant risk.

---METADATA---
VENDOR: getrebuild
PRODUCT: rebuild
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A critical security vulnerability exists in the Rebuild application within the RebuildWebInterceptor class, potentially allowing unauthenticated remote execution.

Executive Summary:
A critical, potentially unauthenticated remote code execution vulnerability has been identified in the getrebuild/rebuild application.

Vulnerability Details

CVE-ID: CVE-2025-50900

Affected Software: getrebuild/rebuild

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the com.rebuild.web.RebuildWebInterceptor class, specifically within the preHandle function. It involves improper handling of input, likely related to codec utility processing, which can be leveraged by an unauthenticated attacker.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete system compromise. Successful exploitation likely leads to full unauthorized access to the underlying server, data exfiltration, and potential for further lateral movement within the network.

Remediation Plan

Immediate Action: Review the vendor advisory provided by the developers of Rebuild to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Monitor for unusual traffic patterns targeting the Rebuild web application and review logs for suspicious function calls associated with the RebuildWebInterceptor class.

Compensating Controls: Place the affected instance behind a WAF and enforce strict IP allow-listing to mitigate the risk of unauthorized external access while a patch is being deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of Aug 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The technical documentation provided is sparse, requiring administrators to monitor the vendor’s official communication channels for specific remediation instructions.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for total system compromise, immediate attention is required. Organizations should prioritize identifying their current version of Rebuild and applying the necessary security updates provided by the vendor as soon as they become available.

Executive Summary:
A critical vulnerability has been identified in multiple products, specifically within the Institute-of-Current-Students 1.0 software. This flaw allows an unauthenticated attacker to retrieve sensitive student details simply by knowing a student's email address, leading to a severe data breach. Immediate patching is required to prevent the mass exposure of Personally Identifiable Information (PII).

Vulnerability Details

CVE-ID: CVE-2025-50870

Affected Software: Unknown Multiple Products, including Institute-of-Current-Students.

Affected Versions: Institute-of-Current-Students version 1.0. See vendor advisory for other specific affected products and versions.

Vulnerability: The application suffers from an Incorrect Access Control vulnerability, also known as an Insecure Direct Object Reference (IDOR). The mydetailsstudent.php endpoint fails to validate if the user requesting data is authorized to view it. An attacker can craft a simple GET request to this endpoint (e.g., https://[target]/mydetailsstudent.php?myds=[student_email]) and substitute any valid student email address to retrieve that student's personal information without authentication.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, reflecting the ease of exploitation and the high impact on confidentiality. Successful exploitation would result in a large-scale data breach of sensitive student PII, such as names, addresses, contact information, and academic records. This could lead to significant reputational damage, loss of trust from students and parents, regulatory fines under data protection laws (e.g., GDPR, FERPA), and potential legal action from affected individuals. The compromised data could also be used for identity theft, phishing, and other malicious activities.

Remediation Plan

Immediate Action: The primary remediation is to identify all instances of the vulnerable software and update to the latest patched version as provided by the vendor. After patching, confirm the vulnerability has been resolved by testing the mydetailsstudent.php endpoint.

Proactive Monitoring: System administrators should actively monitor web server access logs for any requests to the mydetailsstudent.php endpoint. Specifically, look for a high volume of requests from a single IP address or requests enumerating multiple different email addresses in the myds parameter, as these are strong indicators of an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block or rate-limit all requests to the mydetailsstudent.php endpoint. Alternatively, if the endpoint's functionality is not business-critical, disable it entirely or restrict access to it at the network or application level to only trusted, authenticated administrative users.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Aug 1, 2025, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread, active exploitation has been confirmed by CISA. However, the vulnerability is trivial to exploit, requiring only a web browser or a simple script. Proof-of-concept (PoC) exploit code is simple to create and is considered publicly available due to the vulnerability's nature.

Analyst Recommendation
Given the critical CVSS score of 9.8 and the trivial nature of exploitation, this vulnerability poses an immediate and severe risk to the organization. We strongly recommend that all affected systems be identified and patched immediately. This vulnerability should be prioritized with the highest urgency, equivalent to that of a CISA KEV entry, to prevent a potentially devastating data breach.

---METADATA---
VENDOR: ZenTao
PRODUCT: ZenTaoPMS
AFFECTED_VERSIONS: v18.11 through v21.6.beta
---END_METADATA---

Description Summary:
ZenTaoPMS is vulnerable to a directory traversal flaw in its AI module, enabling unauthenticated attackers to achieve remote code execution via malicious file uploads.

Executive Summary:
A critical directory traversal vulnerability in ZenTaoPMS allows unauthenticated attackers to execute arbitrary code on the server through a crafted file upload.

Vulnerability Details

CVE-ID: CVE-2025-50857

Affected Software: ZenTao ZenTaoPMS

Affected Versions: v18.11 through v21.6.beta

Vulnerability: The vulnerability is located in the /module/ai/control.php component. It allows for directory traversal, which an unauthenticated attacker can leverage to upload and execute arbitrary files, leading to full system compromise.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a maximum-severity risk. A successful exploit allows for Remote Code Execution (RCE), giving attackers full access to the server, sensitive project management data, and the ability to pivot into the internal network.

Remediation Plan

Immediate Action: Update ZenTaoPMS to the latest stable version that addresses the directory traversal flaw in the AI module.

Proactive Monitoring: Scan the web server for unauthorized PHP files or shells, particularly in the /module/ai/ directory and temporary upload folders.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules to block directory traversal patterns (e.g., ../) and restrict file upload types at the server level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in project management software are frequently targeted by ransomware groups and state-sponsored actors.

Analyst Recommendation

Due to the potential for unauthenticated Remote Code Execution, this vulnerability must be addressed with the highest priority. Apply the vendor-provided security patches immediately to mitigate the risk of a complete server takeover.

Executive Summary:
A critical command injection vulnerability has been identified in multiple Wavlink products, assigned CVE-2025-50756 with a CVSS score of 9.8. This flaw allows an unauthenticated attacker to execute arbitrary commands on the affected device by sending a specially crafted request to change the administrator password. Successful exploitation results in a complete compromise of the router, enabling attackers to steal data, attack other devices on the network, or disrupt internet access.

Vulnerability Details

CVE-ID: CVE-2025-50756

Affected Software: Wavlink Multiple Products

Affected Versions: The specific version WN535K3 firmware 20191010 is confirmed vulnerable. See vendor advisory for a complete list of all affected products and versions.

Vulnerability: This vulnerability is a command injection flaw within the web administration interface. The set_sys_adm function, which is responsible for updating the administrator's credentials, fails to properly sanitize user-supplied input for the newpass parameter. An attacker can embed operating system commands within this parameter, which are then executed directly by the system shell with root privileges, leading to a full device takeover.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation allows an attacker to gain complete administrative control over the affected network device. The potential business impact is severe and includes theft of sensitive data transiting the network (e.g., credentials, financial data), using the compromised device as a pivot point to attack internal network assets, installation of persistent backdoors or ransomware, and inclusion of the device in a botnet for use in Distributed Denial-of-Service (DDoS) attacks. The reputational damage and operational disruption from such a compromise would be significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security patches provided by the vendor. Organizations must identify all vulnerable Wavlink devices in their environment and update the firmware to the latest version immediately. After patching, review device access logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on network devices. Specifically, monitor web server logs for POST requests to the device's administration panel, inspecting the newpass parameter for shell metacharacters (e.g., ;, |, &, $(), `). Monitor for unusual outbound traffic from the routers, which could indicate communication with a command-and-control (C2) server.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Disable remote (WAN) management of the router's administration interface.
• Restrict access to the administration interface to a dedicated and trusted management network segment.
• If a Web Application Firewall (WAF) is available, configure rules to inspect and block malicious payloads targeting this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 14, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and the simplicity of exploitation, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Due to the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that organizations prioritize patching all affected Wavlink devices immediately. The risk of complete network compromise is high. While there is no current evidence of active exploitation, vulnerabilities of this nature are prime targets for weaponization. If patching is delayed for any reason, the compensating controls listed above must be implemented as an urgent interim measure to mitigate risk.

---METADATA---
VENDOR: Unisite
PRODUCT: CMS
AFFECTED_VERSIONS: 5.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality of Unisite CMS 5.0 allows attackers to execute malicious scripts in the admin panel.

Executive Summary:
A stored XSS vulnerability in Unisite CMS 5.0 allows unauthenticated attackers to execute malicious scripts in the context of an administrator's session.

Vulnerability Details

CVE-ID: CVE-2025-50754

Affected Software: Unisite CMS

Affected Versions: 5.0

Vulnerability: The vulnerability exists in the "Report" functionality, where unsanitized user input is stored and subsequently rendered in the administrative interface, allowing for script execution.

Business Impact

A successful exploit allows an attacker to hijack administrator sessions, steal session cookies, or perform unauthorized administrative actions within the CMS. With a CVSS score of 9.6, this vulnerability poses a major risk to the integrity and confidentiality of the content management system.

Remediation Plan

Immediate Action: Update to the latest version of Unisite CMS that addresses this XSS vulnerability or apply the vendor-provided security patch.

Proactive Monitoring: Inspect the application's reporting logs for suspicious script tags or obfuscated JavaScript within user-submitted content.

Compensating Controls: Implement a Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter and block malicious script payloads from reaching the application.

Exploitation Status

Public Exploit Available: Yes (GitHub PoC repository exists)

Analyst Notes: As of Aug 4, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public PoC increases the likelihood of opportunistic exploitation.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the critical nature of the flaw, administrators must prioritize updating the CMS. Organizations should treat this as an urgent requirement to prevent unauthorized administrative access and potential site-wide compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple Mitrastar products, including the GPT-2741GNAC-N2 model. The flaw allows an attacker to bypass a restricted command shell via SSH access, potentially leading to a full takeover of the affected network device. Successful exploitation could enable an attacker to intercept network traffic, access internal networks, or disrupt services.

Vulnerability Details

CVE-ID: CVE-2025-50753

Affected Software: Mitrastar Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The affected Mitrastar devices provide SSH access that defaults to a restricted shell, which is intended to limit administrative capabilities. However, a vulnerability exists within this restricted environment that allows for a "shell escape." An attacker with SSH access, potentially using default or weak credentials, can execute a specific sequence of commands to break out of the restricted shell and gain privileged (root-level) access to the underlying operating system of the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.4. A successful exploit would grant an attacker complete control over the compromised network device. This could lead to severe consequences, including man-in-the-middle attacks to eavesdrop on network traffic, unauthorized access to sensitive internal network segments, deployment of malware, or using the device as a pivot point for further attacks. The potential for data breaches, operational disruption, and reputational damage is significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by Mitrastar to all affected devices immediately. Patching this vulnerability is the most effective way to mitigate the risk.

Proactive Monitoring: Security teams should actively monitor for signs of compromise. This includes reviewing SSH access logs for unauthorized or suspicious login attempts, especially from external IP addresses. Monitor network traffic for unusual outbound connections from the Mitrastar devices, which could indicate a successful compromise and communication with a command-and-control server.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce the attack surface:

• Use a firewall or Access Control Lists (ACLs) to restrict SSH access to the devices from only trusted IP addresses or dedicated management networks.
• If SSH access is not essential for business operations, disable the service entirely on the devices.
• Ensure all default credentials have been changed to strong, unique passwords.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 27, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high CVSS score and the straightforward nature of shell escape vulnerabilities, it is highly likely that proof-of-concept exploits will be developed and published by security researchers or threat actors in the near future.

Analyst Recommendation

Given the high severity (CVSS 8.4) of this vulnerability and the risk of complete device compromise, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. Although this CVE is not currently listed on the CISA KEV catalog, its high impact makes it a prime candidate for future inclusion. Until patches are fully deployed, organizations must implement the suggested compensating controls, such as restricting SSH access, to mitigate immediate risk.

Executive Summary:
A critical vulnerability exists in The Memos application that allows an attacker to force the server to make requests to arbitrary URLs. By embedding a malicious image link in a memo, an attacker can scan an organization's internal network, access internal services, and potentially steal sensitive data or credentials. This vulnerability represents a significant risk of internal system compromise and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-50738

Affected Software: The Memos Multiple Products

Affected Versions: All versions up to and including v0.24.3

Vulnerability:
The vulnerability is a Server-Side Request Forgery (SSRF). The Memos application fails to properly validate the URLs provided within markdown for embedding images. An attacker with the ability to create or edit a memo can insert a markdown image tag pointing to an internal network address (e.g., http://192.168.1.100/dashboard, http://169.254.169.254/latest/meta-data). When any user views this memo, the application server, not the user's browser, fetches the content from the malicious URL. This allows the attacker to use the Memos server as a proxy to interact with services on the internal network that are not exposed to the internet, including internal APIs, admin panels, and cloud provider metadata services.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, posing a direct and severe threat to the organization. Exploitation can lead to a complete compromise of confidentiality and integrity of data accessible by the Memos server. Potential consequences include the exfiltration of sensitive corporate data, theft of cloud infrastructure credentials (e.g., AWS IAM roles), and providing an attacker with a pivot point to launch further attacks against other systems within the internal network. A successful exploit could result in a major data breach, significant financial loss, and severe reputational damage.

Remediation Plan

Immediate Action:
Immediately update all instances of The Memos to a version later than v0.24.3, as this is the primary remediation step recommended by the vendor. After patching, monitor application and network logs for any signs of exploitation that may have occurred prior to the update. Review access logs to identify any unusual memo creation or viewing activity.

Proactive Monitoring:
Monitor outbound network traffic from the server(s) hosting The Memos application. Specifically, look for HTTP/HTTPS requests originating from the server to internal IP address ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to known cloud metadata endpoints (e.g., 169.254.169.254). Alert on any such traffic, as it is a strong indicator of an exploitation attempt.

Compensating Controls:
If patching cannot be performed immediately, implement strict network egress filtering as a temporary measure. Configure firewall rules to block all outbound connections from the Memos server to internal network destinations and cloud metadata services. Only allow outbound traffic to known, required external domains. A Web Application Firewall (WAF) with rules to detect and block common SSRF patterns can also provide an additional layer of defense.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of Jul 29, 2025, there are no known public exploits for this vulnerability. However, because SSRF vulnerabilities in markdown processors are well understood, a functional exploit can be developed with minimal effort. Organizations should assume that attackers will begin targeting this vulnerability immediately following its public disclosure and act accordingly.

Analyst Recommendation
Given the critical 9.8 CVSS score and the direct path to internal network compromise, this vulnerability requires immediate attention. We strongly recommend that all organizations patch affected instances of The Memos without delay. Although this CVE is not currently on the CISA KEV list, its severity makes it a high-priority candidate for patching. If patching is delayed for any reason, the compensating controls, especially egress filtering, must be implemented as an urgent priority to mitigate the risk of a breach.

Executive Summary:
A high-severity directory traversal vulnerability, identified as CVE-2025-50735, has been discovered in multiple NextChat thru products. This flaw could allow a remote, unauthenticated attacker to bypass security restrictions and access sensitive files on the underlying server. Successful exploitation could lead to the exposure of confidential data, system credentials, or other critical information, posing a significant risk to the organization's security and data integrity.

Vulnerability Details

CVE-ID: CVE-2025-50735

Affected Software: NextChat thru Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a directory traversal (also known as path traversal) vulnerability. It exists because the application fails to properly sanitize user-supplied input for file or directory paths. A remote, unauthenticated attacker can exploit this by sending a specially crafted request containing "dot-dot-slash" (../) sequences to an exposed application endpoint. This manipulation tricks the application into navigating outside of the intended web root directory, allowing the attacker to read, and potentially write or delete, arbitrary files on the server's file system with the permissions of the web server user.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a significant negative impact on the business. An attacker could access confidential data, including customer information, intellectual property, application source code, and configuration files containing database credentials or API keys. This could lead to a major data breach, resulting in severe reputational damage, regulatory fines, and loss of customer trust. Furthermore, if the vulnerability allows file modification, an attacker could deface the website, plant a backdoor for persistent access, or cause a denial-of-service condition by deleting critical system files.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all affected systems. After patching, monitor for any signs of exploitation attempts by reviewing web server and application access logs for suspicious patterns indicative of directory traversal attacks.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. Review web server access logs for requests containing directory traversal sequences such as ../, ..%2f, or ..%5c. Configure Intrusion Detection/Prevention Systems (IDS/IPS) to alert on and block known directory traversal attack signatures. Implement File Integrity Monitoring (FIM) on critical server files to detect any unauthorized modifications.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) and enable rules designed to detect and block directory traversal attacks. Additionally, harden file system permissions to ensure the web server's service account has read/write access only to the directories it absolutely requires, restricting its ability to access sensitive system-level files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 3, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, directory traversal is a well-understood vulnerability class, and threat actors can develop exploits for such flaws relatively quickly after a public disclosure.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and its potential for enabling unauthorized access to sensitive data, we strongly recommend that organizations prioritize the immediate application of the vendor-supplied security patches. Although this CVE is not currently listed on the CISA KEV list, its impact warrants urgent attention. All internet-facing instances of affected NextChat thru products should be considered at high risk. If immediate patching is not feasible, the compensating controls outlined above, particularly the use of a WAF, should be implemented as a temporary mitigation.

Executive Summary:
A critical vulnerability, identified as CVE-2025-50722, has been discovered in the sparkshop application, carrying a CVSS score of 9.8. This flaw stems from insecure file permissions, which could allow a remote, unauthenticated attacker to execute arbitrary code and gain complete control over the affected server. Successful exploitation could lead to total system compromise, data theft, and significant service disruption.

Vulnerability Details

CVE-ID: CVE-2025-50722

Affected Software: sparkshop

Affected Versions: Version 1.1.7 is confirmed to be vulnerable. See vendor advisory for a complete list of affected versions and products.

Vulnerability: The vulnerability is an insecure permissions flaw within the Common.php component of the sparkshop application. The file permissions may allow the web server process to write to this file, a function that should be read-only. A remote attacker could exploit this by crafting a request that overwrites the contents of Common.php with malicious PHP code. When the application subsequently includes or executes this modified file, the attacker's code will run on the server with the privileges of the web server user, resulting in remote code execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit grants an attacker complete control over the application server, posing an extreme risk to the organization. Potential consequences include the theft of sensitive data such as customer information and payment details, deployment of ransomware, disruption of business operations, and reputational damage. The compromised server could also be used as a pivot point to launch further attacks against the internal network, escalating the security incident significantly.

Remediation Plan

Immediate Action: Organizations must immediately update all vulnerable instances of sparkshop to the latest patched version as recommended by the vendor. After patching, it is crucial to monitor systems for any signs of compromise that may have occurred prior to remediation by reviewing access logs for unusual activity related to the Common.php file.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes scrutinizing web server logs for unusual POST requests or attempts to modify application files. Implement file integrity monitoring (FIM) to generate alerts on any unauthorized changes to Common.php or other core application files. Monitor for anomalous outbound network traffic from the web server, which could indicate a successful compromise and communication with a command-and-control server.

Compensating Controls: If immediate patching is not feasible, apply the following compensating controls:

• Modify the file system permissions for Common.php and other critical application files to be read-only for the web server user.
• Deploy a Web Application Firewall (WAF) with rules designed to block requests attempting to write to PHP files or exploit this specific vulnerability.
• Enhance network segmentation to isolate the affected server, limiting an attacker's ability to move laterally within the network if the system is compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 25, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity (CVSS 9.8) and the relative simplicity of exploiting insecure file permissions for RCE, it is highly probable that a functional exploit will be developed and released by threat actors in the near future.

Analyst Recommendation

Given the critical severity of CVE-2025-50722, we strongly recommend that organizations treat this as an emergency and apply the vendor-supplied patch to all affected sparkshop instances immediately. The potential for complete system compromise represents an unacceptable risk. While this vulnerability is not currently listed on the CISA KEV list, its high-impact nature makes it a prime candidate for future inclusion. Prioritize patching and implement the recommended monitoring and compensating controls without delay.

Executive Summary:
A critical remote code execution (RCE) vulnerability has been identified in a specific version of the ThinkPHP framework, a popular web application development platform. This flaw allows a remote, unauthenticated attacker to execute arbitrary commands on the server by sending a specially crafted request, potentially leading to a complete system compromise, data theft, and service disruption. Due to the ease of exploitation and the severity of the impact, this vulnerability poses a significant and immediate risk to affected organizations.

Vulnerability Details

CVE-ID: CVE-2025-50707

Affected Software: ThinkPHP

Affected Versions: ThinkPHP v.3.2.5

Vulnerability: The vulnerability exists due to improper input sanitization within the URL routing mechanism handled by the index.php component. A remote attacker can construct a malicious URL that bypasses security validations and manipulates the application's controller and action parameters. This allows the attacker to call arbitrary system functions, resulting in remote code execution on the server with the permissions of the web service account.

Business Impact

This vulnerability is rated as Critical with a CVSS score of 9.8, signifying a high risk to the business. Successful exploitation grants an attacker complete control over the affected web application and underlying server. This could lead to severe consequences, including the theft of sensitive data (customer information, intellectual property, financial records), defacement of the website, complete service outages, or the use of the compromised server as a pivot point to attack other systems on the internal network. The potential for significant financial loss, regulatory fines, and reputational damage is extremely high.

Remediation Plan

Immediate Action: Update the affected ThinkPHP framework to the latest secure version provided by the vendor. After patching, it is crucial to monitor for any signs of post-compromise activity and review historical access logs for indicators of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Implement enhanced monitoring on affected web servers. Security teams should look for suspicious GET or POST requests to index.php containing unusual or obfuscated strings in the URL parameters. Monitor for unexpected processes being spawned by the web server user (e.g., www-data, apache) and any anomalous outbound network connections from the web server.

Compensating Controls: If patching cannot be immediately deployed, implement a Web Application Firewall (WAF) with rules specifically designed to block the malicious request patterns associated with this vulnerability. Additionally, ensure the web server operates with the principle of least privilege and that the server is segmented from critical internal network resources to limit the potential blast radius of a compromise.

Exploitation Status

Public Exploit Available: False (as of Aug 5, 2025)

Analyst Notes: As of the publication date, there is no known public exploit code available for this vulnerability. However, due to the critical nature of remote code execution flaws in widely used frameworks, it is highly probable that threat actors will reverse-engineer the patch and develop a functional exploit in the near future. Organizations should assume active exploitation is imminent.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the potential for a full system compromise, this vulnerability requires immediate attention. Although CVE-2025-50707 is not currently on the CISA Known Exploited Vulnerabilities (KEV) list, its high impact makes it an attractive target for attackers. We strongly recommend that organizations identify all instances of the vulnerable ThinkPHP version and apply the vendor-supplied patches as the highest priority. If patching is delayed, the compensating controls outlined above must be implemented immediately to reduce the risk of exploitation.

Executive Summary:
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-50706, has been discovered in the ThinkPHP framework. This flaw allows an unauthenticated remote attacker to take complete control of an affected web server by sending a specially crafted request. Successful exploitation could lead to total system compromise, data theft, and significant service disruption.

Vulnerability Details

CVE-ID: CVE-2025-50706

Affected Software: ThinkPHP

Affected Versions: Version 5.1 is explicitly mentioned. See vendor advisory for a complete list of affected versions and products.

Vulnerability: The vulnerability exists within the routecheck function of the ThinkPHP framework. Due to improper input validation, an attacker can craft a malicious URL or request payload that is not correctly sanitized by the routing mechanism. This allows the injection and execution of arbitrary PHP code on the underlying server, operating with the permissions of the web server process.

Business Impact

This vulnerability is rated as Critical with a CVSS score of 9.8. Exploitation can lead to a complete compromise of the affected web application and server. The potential business impact includes theft of sensitive data such as customer information or intellectual property, website defacement, service outages, and the use of the compromised server to launch further attacks against the internal network. Such an incident could result in severe reputational damage, financial loss, and potential regulatory penalties.

Remediation Plan

Immediate Action: The primary remediation is to update all affected ThinkPHP instances to the latest secure version as recommended by the vendor. After patching, it is crucial to review web server access logs and application logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes analyzing web server logs for unusual or malformed requests targeting the application's routing endpoints. Monitor system processes for unexpected command execution by the web server user and scrutinize outbound network traffic for connections to unknown or suspicious destinations.

Compensating Controls: If immediate patching is not feasible, organizations should implement a Web Application Firewall (WAF) with virtual patching rules designed to block known exploit patterns for this CVE. Additionally, ensure the web server runs with the lowest possible privileges and consider network segmentation to limit an attacker's ability to move laterally if the server is compromised.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Aug 5, 2025, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity, the popularity of the ThinkPHP framework, and the availability of public proof-of-concept exploit code, active exploitation by threat actors is highly likely and should be assumed.

Analyst Recommendation

Due to the critical nature (CVSS 9.8) and the high likelihood of active exploitation, this vulnerability poses a severe and immediate risk to the organization. We strongly recommend that all systems running the affected ThinkPHP versions be patched immediately. If patching cannot be performed right away, apply the suggested compensating controls, particularly WAF rules, as a temporary measure. This vulnerability should be treated with the highest priority, equivalent to those on the CISA KEV list.

Executive Summary:
A high-severity vulnerability has been discovered in multiple versions of igmpproxy, a widely used multicast routing daemon. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted network packet, causing the service to crash and resulting in a denial-of-service condition. This can disrupt critical network services that rely on multicast traffic, such as IPTV and real-time data streaming.

Vulnerability Details

CVE-ID: CVE-2025-50681

Affected Software: igmpproxy Multiple Products

Affected Versions: See vendor advisory for specific affected versions. All versions prior to 0.4 are believed to be vulnerable.

Vulnerability: The vulnerability is a heap-based buffer overflow within the IGMP (Internet Group Management Protocol) packet parsing function of the igmpproxy daemon. An attacker can send a malformed IGMP packet to a vulnerable device, which the daemon fails to validate correctly. This leads to writing data beyond the allocated buffer, corrupting memory and causing the igmpproxy process to terminate, resulting in a denial-of-service. Exploitation requires no authentication and can be performed remotely by any attacker with network access to the affected service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation would lead to a denial-of-service, directly impacting the availability of services dependent on multicast routing. For organizations using igmpproxy to facilitate services like IPTV, video conferencing, financial market data feeds, or other real-time streaming applications, an outage could result in significant business disruption, financial loss, and reputational damage. The primary risk is an immediate and complete loss of multicast-dependent services until the igmpproxy daemon is manually restarted.

Remediation Plan

Immediate Action:

• Identify all network devices running a vulnerable version of the igmpproxy software.
• Apply the security updates or patches provided by the vendor immediately to remediate the vulnerability.
• After patching, reboot the service and confirm that it is operating correctly and the version has been successfully updated.

Proactive Monitoring:

• Monitor system logs for unexpected crashes or restarts of the igmpproxy process.
• Analyze network traffic for an unusual volume of IGMP packets or malformed packets targeting devices running igmpproxy.
• Implement alerts for service availability to detect outages of multicast-dependent applications promptly.

Compensating Controls:

• If immediate patching is not feasible, implement strict firewall rules to restrict access to the igmpproxy service from untrusted networks or unauthorized IP addresses.
• Deploy an Intrusion Prevention System (IPS) with signatures designed to detect and block attempts to exploit this specific vulnerability.
• Ensure the service is configured to restart automatically upon failure to minimize the duration of a potential outage.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 21, 2025, there are no known public exploits or active exploitation attempts in the wild. However, given the nature of the buffer overflow, it is anticipated that a functional proof-of-concept exploit for denial-of-service could be developed with minimal effort by security researchers or threat actors.

Analyst Recommendation

Due to the high severity (CVSS 7.5) and the critical role igmpproxy plays in maintaining multicast network services, immediate patching is strongly recommended. Although this vulnerability is not currently listed on the CISA KEV catalog and no active exploitation has been observed, the low complexity of a potential attack creates a significant risk of service disruption. Organizations should prioritize the deployment of vendor-supplied updates to all affected systems to prevent potential outages.

Executive Summary:
A high-severity vulnerability has been discovered in the password change functionality of multiple products from the vendor "issue." This flaw could allow an attacker to change user passwords without proper authorization, potentially leading to a complete system compromise by escalating privileges to an administrative level. Organizations are urged to apply the vendor-supplied security patches immediately to prevent unauthorized access and protect sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-50674

Affected Software: issue Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the changePassword method located in the /usr/share/php/openmediavault/system/user file. This function fails to properly validate or enforce authorization checks when a password change is requested. An authenticated attacker with low-level privileges could exploit this flaw by crafting a specific request to change the password of any other user on the system, including administrative accounts. Successful exploitation results in privilege escalation, granting the attacker unauthorized administrative control over the affected system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8, posing a significant risk to the organization. Successful exploitation could lead to a full system compromise, allowing an attacker to access, modify, or exfiltrate sensitive data, disrupt critical services, and install malicious software. The primary business risks include data breaches, loss of system integrity and confidentiality, operational downtime, and the potential for an attacker to use the compromised system as a pivot point for further attacks within the corporate network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to review system access logs for any unauthorized password changes or suspicious administrative logins that may have occurred prior to the patch application.

Proactive Monitoring: Implement enhanced monitoring of authentication and system logs. Specifically, look for multiple failed login attempts followed by a successful one from an unusual IP address, password change events for administrative accounts initiated by non-administrative users, and any unexpected commands being executed by the web server process.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls:

• Restrict network access to the device's management interface to a dedicated and trusted administrative network or specific IP addresses.
• Deploy a Web Application Firewall (WAF) with rulesets designed to inspect and block malicious requests targeting the password change endpoint.
• Enforce Multi-Factor Authentication (MFA) on all administrative accounts to provide an additional layer of security, mitigating the risk of a compromised password.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 22, 2025, there are no known public proof-of-concept exploits or observed in-the-wild attacks leveraging this vulnerability. However, due to the high severity and relative simplicity of exploitation, the likelihood of threat actor activity targeting this flaw is expected to increase rapidly.

Analyst Recommendation

Given the high CVSS score of 7.8 and the critical impact of privilege escalation, we strongly recommend that organizations prioritize patching this vulnerability immediately, starting with internet-facing systems. Although this CVE is not currently on the CISA KEV list, its severity makes it a prime target for future exploitation. Organizations should treat this as an urgent threat and apply all recommended remediation and monitoring actions without delay to prevent a potential system compromise.

Here is the professional vulnerability analysis report in the specified format.

Executive Summary:
A high-severity vulnerability exists within the WP Import Export Lite plugin for WordPress, allowing an attacker to upload malicious files to a target website. This flaw could be exploited to execute arbitrary code, potentially leading to a complete compromise of the website, data theft, and reputational damage.

Vulnerability Details

CVE-ID: CVE-2025-5061

Affected Software: WordPress WP Import Export Lite plugin

Affected Versions: All versions up to, and including, version 3.

Vulnerability: The vulnerability is an Arbitrary File Upload in the wpie_parse_upload_data function. This function lacks proper server-side validation to ensure that uploaded files are of an expected and safe file type (e.g., CSV, XML). An authenticated attacker with access to the plugin's import functionality can bypass client-side restrictions and upload a malicious script, such as a PHP web shell, disguised as a legitimate import file. Once the malicious file is on the server, the attacker can access it via its URL to execute code in the security context of the web server, leading to remote code execution (RCE).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could have a significant negative impact on the business. The primary risk is remote code execution, which can lead to a complete compromise of the web server. Potential consequences include the theft of sensitive data such as customer information or intellectual property, website defacement causing reputational harm, and financial losses from downtime or regulatory fines. A compromised server could also be used to attack other systems within the network or serve malware to visitors, further escalating the damage.

Remediation Plan

Immediate Action:

• Immediately update the WP Import Export Lite plugin to the latest version available from the vendor, which is confirmed to be patched against this vulnerability.
• If the plugin is not essential for business operations, the recommended course of action is to disable and completely uninstall it to eliminate the attack surface.
• Review WordPress user roles and permissions to ensure that only trusted users have the ability to upload files.

Proactive Monitoring:

• Log Analysis: Monitor web server access logs for suspicious POST requests to the plugin's upload endpoints. Scrutinize the WordPress uploads directory for any files with executable extensions (e.g., .php, .phtml, .php5).
• File Integrity Monitoring (FIM): Utilize a FIM solution to detect any unauthorized changes or additions to WordPress core, theme, and plugin files.
• Network Traffic Analysis: Monitor for any unusual outbound network connections from the web server, which could indicate a command-and-control (C2) channel established by an attacker.

Compensating Controls:

• Web Application Firewall (WAF): Implement a WAF with rules designed to block the upload of files with dangerous extensions and to filter malicious request patterns targeting the vulnerable plugin.
• Harden Server Permissions: Configure web server and file system permissions to prevent the execution of scripts from the uploads directory. For Apache, this can be achieved using an .htaccess file with rules to deny script execution.
• Plugin Deactivation: If patching cannot be performed immediately, disable the plugin until the update can be safely deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, arbitrary file upload vulnerabilities in widely used WordPress plugins are a common target for threat actors, and proof-of-concept exploits are often developed and published quickly following disclosure.

Analyst Recommendation

Given the high-severity rating (CVSS 7.5) and the risk of remote code execution, this vulnerability requires immediate attention. Although it is not currently listed in the CISA KEV catalog, its potential for complete system compromise presents a critical risk. It is strongly recommended that all organizations using the WP Import Export Lite plugin prioritize applying the vendor's patch immediately. If the plugin is not business-critical, it should be removed to mitigate this threat entirely.

Executive Summary:
A high-severity authentication bypass vulnerability has been identified in the Bravis User plugin for WordPress. This flaw allows an unauthenticated attacker to gain unauthorized access to the affected website, potentially with administrative privileges. Successful exploitation could lead to a complete compromise of the website, data theft, or further attacks launched from the compromised server.

Vulnerability Details

CVE-ID: CVE-2025-5060

Affected Software: WordPress Bravis User plugin

Affected Versions: All versions up to, and including, 1

Vulnerability: The Bravis User plugin contains an authentication bypass vulnerability. This flaw allows a remote, unauthenticated attacker to circumvent the standard login process by sending a specially crafted request to the target website. By exploiting this vulnerability, an attacker can gain access to an existing user's account, including administrative accounts, without needing to provide valid credentials, leading to a full compromise of the WordPress site.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. A successful exploit could have significant negative impacts on the business. An attacker with administrative access can deface the website, steal sensitive customer or user data, inject malicious code to attack site visitors, and use the server for malicious activities like hosting phishing pages or sending spam. Such an incident can lead to severe reputational damage, loss of customer trust, regulatory fines for data breaches, and significant financial costs for incident response and recovery.

Remediation Plan

Immediate Action: Immediately update the Bravis User plugin to the latest patched version provided by the developer. If the plugin is not essential to business operations, the recommended course of action is to deactivate and completely remove it to eliminate the attack surface. After applying the update, review all WordPress user accounts, especially those with administrative privileges, for any signs of unauthorized activity.

Proactive Monitoring: Monitor web server access logs and WordPress security logs for unusual login attempts or direct access to administrative pages from unknown IP addresses. Watch for the creation of new, unauthorized administrative accounts or unexpected modifications to website files, themes, or other plugins. An increase in requests to plugin-specific endpoints could indicate scanning or exploitation attempts.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) with virtual patching rules to block exploit attempts targeting this vulnerability. Restrict access to the WordPress administrative dashboard (/wp-admin/) to trusted IP addresses only. Enforce multi-factor authentication (MFA) for all users, as it may provide an additional layer of security against some exploitation methods.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 24, 2025, there is no known public proof-of-concept exploit code, and the vulnerability is not reported to be actively exploited in the wild. However, given the critical nature of authentication bypass vulnerabilities, threat actors are likely to develop exploits rapidly.

Analyst Recommendation
Due to the high severity (CVSS 8.1) of this vulnerability, we strongly recommend immediate action. The ability for an unauthenticated attacker to gain full administrative control presents a critical risk to the organization. All WordPress sites using the Bravis User plugin must be identified and patched immediately by updating to the latest version. If the plugin is non-essential, it should be removed as the most effective mitigation. Although this vulnerability is not currently on the CISA KEV list, its critical impact warrants urgent attention to prevent a potential website compromise.

---METADATA---
VENDOR: Danphe Health
PRODUCT: Hospital Management System EMR
AFFECTED_VERSIONS: 3.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Danphe Health Hospital Management System EMR 3.2 allows unauthenticated attackers to reset arbitrary user account passwords via the SecuritySettingsController.

Executive Summary:
A critical account takeover vulnerability in Danphe Health Hospital Management System EMR 3.2 allows unauthenticated attackers to reset any user password.

Vulnerability Details

CVE-ID: CVE-2025-50594

Affected Software: Danphe Health Hospital Management System EMR

Affected Versions: 3.2

Vulnerability: The flaw resides in SecuritySettingsController.cs, which fails to properly validate authorization during the password reset process. This allows an unauthenticated attacker to trigger password changes for any user in the system.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Unauthorized access to an EMR system can lead to the theft of sensitive Protected Health Information (PHI), violation of regulatory compliance standards (e.g., HIPAA), and severe reputational damage to the healthcare provider.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the necessary security patch or hotfix for version 3.2.

Proactive Monitoring: Audit user account management logs for suspicious password reset activity or unauthorized administrative actions.

Compensating Controls: Restrict access to the EMR web interface to internal, trusted networks using VPNs or strict IP whitelisting to prevent external exploitation.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to the potential for immediate, unauthorized account takeover.

Analyst Recommendation

This vulnerability is of the highest urgency given the sensitivity of the data handled by EMR systems. Administrators must assume the system is at risk and implement strict access controls while working with the vendor to apply the corrective update.

Executive Summary:
A critical vulnerability has been identified in a specific version of the LinuxServer.io heimdall application. This flaw allows an unauthenticated remote attacker to manipulate HTTP headers to potentially take control of the application, redirect users to malicious sites, or access sensitive information. Due to its critical severity and the ease of exploitation, this vulnerability poses a significant and immediate risk to the organization's security posture.

Vulnerability Details

CVE-ID: CVE-2025-50578

Affected Software: LinuxServer.io heimdall

Affected Versions: 2.6.3-ls307

Vulnerability: The vulnerability exists in the application's processing of user-supplied HTTP headers, specifically the X-Forwarded-Host and Referer headers. The application improperly trusts the values in these headers, which can be controlled by an attacker. A remote, unauthenticated attacker can craft a malicious HTTP request with a manipulated header value to trigger various attacks, such as web cache poisoning, password reset link poisoning, or Server-Side Request Forgery (SSRF), potentially leading to a full compromise of the application and the underlying server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high potential for severe business impact. Successful exploitation could grant an attacker complete control over the Heimdall application dashboard, which often serves as a central hub for accessing other critical internal applications and services. This could lead to the exposure of sensitive credentials, unauthorized access to internal systems, data breaches, and lateral movement within the network. The compromised server could also be used to launch further attacks, resulting in significant operational disruption and reputational damage.

Remediation Plan

Immediate Action: Immediately update all instances of LinuxServer.io heimdall to the latest version as recommended by the developer. After patching, review web server and application access logs for any signs of attempted or successful exploitation that may have occurred prior to the update.

Proactive Monitoring: Implement monitoring rules to detect and alert on suspicious web requests to the Heimdall application. Specifically, look for unusual or malformed values in the X-Forwarded-Host and Referer headers in web server logs (e.g., Nginx, Apache). Monitor for unexpected outbound network connections from the server hosting Heimdall, which could indicate a successful SSRF attack.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) to inspect, sanitize, and block malicious requests containing manipulated X-Forwarded-Host and Referer headers. Additionally, restrict network access to the Heimdall dashboard to only trusted IP addresses and networks to reduce the external attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 30, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical CVSS score and the unauthenticated nature of the vulnerability, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that immediate action be taken. All vulnerable instances of LinuxServer.io heimdall must be patched without delay. Although there is no evidence of active exploitation at this time, the risk of compromise is severe. Organizations should prioritize this update and implement the recommended compensating controls and proactive monitoring to defend against potential future attacks.

Executive Summary:
A critical vulnerability has been identified in the Saurus CMS Community Edition, assigned a maximum severity score of 10.0. This flaw allows an unauthenticated attacker to remotely execute arbitrary code on the server, leading to a complete system compromise. Organizations using the affected software are at immediate risk of data theft, service disruption, and full server takeover.

Vulnerability Details

CVE-ID: CVE-2025-50567

Affected Software: Saurus CMS Community Edition Multiple Products

Affected Versions: Version 4.7.1 and potentially prior versions. See vendor advisory for specific affected versions.

Vulnerability: The vulnerability exists within the custom DB::prepare() function of the Saurus CMS application. This function utilizes the preg_replace() PHP function with the /e (PREG_REPLACE_EVAL) modifier, which has been deprecated due to its inherent security risks. The /e modifier instructs preg_replace() to treat the replacement string as PHP code and execute it. An attacker can craft a malicious input that, when processed by this function as a SQL query parameter, will be executed as code on the server, resulting in Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10, representing the highest possible risk. Successful exploitation would grant an attacker complete control over the web server hosting the Saurus CMS instance. The potential consequences include, but are not limited to, theft of all data stored in the CMS database (such as customer information, user credentials, and proprietary content), unauthorized modification of the website, service disruption, and using the compromised server to launch further attacks against the organization's internal network or external targets. This could lead to significant financial loss, regulatory penalties, and severe reputational damage.

Remediation Plan

Immediate Action: The most effective mitigation is to immediately apply the security updates provided by the vendor. Administrators must Update Saurus CMS Community Edition Multiple Products to the latest version to patch the vulnerable DB::prepare() function. Following the update, it is crucial to monitor for exploitation attempts and review access logs for any signs of compromise that may have occurred prior to patching.

Proactive Monitoring:

• Web Server Logs: Scrutinize web server (e.g., Apache, Nginx) access and error logs for unusual POST or GET requests. Look for requests containing PHP code, shell commands, or suspicious character sequences (e.g., eval(), system(), passthru()) within query parameters.
• File Integrity Monitoring (FIM): Implement FIM to detect unauthorized changes to core CMS files or the creation of new files (e.g., web shells) in web-accessible directories.
• Network Traffic: Monitor for anomalous outbound connections from the Saurus CMS server, which could indicate a successful compromise and communication with an attacker's command-and-control server.

Compensating Controls: If patching cannot be performed immediately, the following temporary controls can reduce the risk of exploitation:

• Web Application Firewall (WAF): Deploy a WAF with a strict ruleset designed to block common code injection and command injection attack patterns in web requests.
• Network Segmentation: Isolate the server hosting Saurus CMS from other critical internal systems to prevent lateral movement in the event of a compromise.
• Least Privilege: Ensure the web server's user account has the minimum permissions necessary to function, limiting an attacker's ability to impact the underlying operating system.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 19, 2025, there are no known public exploits for this vulnerability. However, the vulnerability stems from the use of a deprecated and notoriously insecure programming practice (preg_replace /e). This makes the vulnerability relatively straightforward to exploit by a skilled attacker, and it is highly likely that a functional exploit will be developed and released publicly in the near future. The CVSS score of 10 reflects that the vulnerability is remotely exploitable with low complexity and requires no user interaction.

Analyst Recommendation

Given the critical severity (CVSS 10) of this vulnerability and the high probability of exploit development, we strongly recommend that organizations treat this as an emergency. Immediate patching of all affected Saurus CMS instances is the highest priority. If patching is delayed for any reason, compensating controls, especially a properly configured Web Application Firewall, must be implemented without delay. Although this CVE is not currently on the CISA KEV catalog, its critical nature makes it a prime candidate for future inclusion, and organizations should act proactively to prevent a potential compromise.

---METADATA---
VENDOR: Netgear
PRODUCT: EX8000
AFFECTED_VERSIONS: 1.0.0.126
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Netgear EX8000 range extender, specifically version 1.0.0.126, contains a command injection vulnerability in the switch_status function, allowing unauthenticated remote code execution.

Executive Summary:
Netgear EX8000 version 1.0.0.126 is vulnerable to command injection, permitting unauthenticated attackers to execute arbitrary commands on the device.

Vulnerability Details

CVE-ID: CVE-2025-50526

Affected Software: Netgear EX8000

Affected Versions: 1.0.0.126

Vulnerability: The vulnerability resides in the switch_status function, which fails to sanitize user-supplied input before passing it to a system shell. This allows an unauthenticated attacker to inject and execute arbitrary system commands on the affected hardware.

Business Impact

Exploitation of this vulnerability grants an attacker full administrative control over the networking device. With a CVSS score of 9.8, this could lead to the interception of network traffic, unauthorized access to internal resources, or the device being recruited into a botnet for further attacks.

Remediation Plan

Immediate Action: Check the official Netgear support portal for firmware updates addressing this issue. If no update is available, isolate the device from public-facing network segments immediately.

Proactive Monitoring: Monitor the device's management interface logs for unauthorized access attempts or unusual configuration changes, particularly those involving the switch_status functionality.

Compensating Controls: Use network segmentation to ensure the EX8000 is not directly exposed to the internet, and disable remote management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Dec 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Command injection in networking gear is a high-priority risk due to the potential for persistent, low-visibility access.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to isolate affected devices. Administrators should ensure that firmware is kept current and that devices are protected by strong perimeter security, as network devices are frequent targets for persistent threat actors.

---METADATA---
VENDOR: libcoap
PRODUCT: libcoap
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the libcoap library's coap_delete_pdu_lkd function may allow for remote code execution or system instability.

Executive Summary:
A critical use-after-free vulnerability in the libcoap library presents a significant risk of remote code execution for applications utilizing this library.

Vulnerability Details

CVE-ID: CVE-2025-50518

Affected Software: libcoap

Affected Versions: See vendor advisory

Vulnerability: This is a use-after-free vulnerability occurring in the coap_delete_pdu_lkd function within coap_pdu.c. It can be triggered by an unauthenticated attacker, potentially leading to service crashes or arbitrary code execution.

Business Impact

The ability for an unauthenticated attacker to trigger a use-after-free condition in a networking library creates a high risk of service disruption or system compromise. With a CVSS score of 9.8, this vulnerability is highly critical for any infrastructure relying on libcoap, as it could lead to full system takeover.

Remediation Plan

Immediate Action: Review the libcoap project's official security advisories and GitHub issues to identify the specific patched release.

Proactive Monitoring: Monitor system logs for unexpected crashes or segmentation faults in services that utilize the libcoap library.

Compensating Controls: Restrict network access to services utilizing libcoap using network segmentation or firewall rules to limit the exposure of the library to untrusted traffic.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Use-after-free vulnerabilities are notoriously difficult to defend against once a stable exploit is developed.

Analyst Recommendation

Organizations using libcoap must prioritize monitoring the project's upstream repository for a fix. Given the high CVSS score and the existence of a proof-of-concept, users should treat this as a high-priority item and prepare to patch as soon as the vendor releases a security update.