CVE-2025-34xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
979 records · Page 7 of 10
- CVE-2025-34399: MailEnable < 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspx 5.3 Medium
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the JavaScript variable var sAddrCc. By supplying a crafted payload that terminates the existing LoadCurAdd
Updated - CVE-2025-34398: MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx 5.3 Medium
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesBcc value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the JavaScript variable var sAddrBcc. By supplying a crafted payload that terminates the existing LoadCur
Updated - CVE-2025-34397: MailEnable < 10.54 Reflected XSS in Message Parameter of Mobile/Compose.aspx 5.3 Medium
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Message parameter of /Mobile/Compose.aspx. The Message value is not properly sanitized when processed via a GET request and is reflected into a JavaScript context in the response. By supplying a crafted payload that terminates the existing script block/function, injects attacker-controlled JavaSc
Updated MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAINFY.DLL from its application directo without sufficient integrity validation or secure search order. If the DLL is missing or attacker-writable locations in the search path are used, a local attacker with write
UpdatedBarracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can be escalated to remote code execution by retrieving the .NET machine keys.
Updated- CVE-2025-34394: Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE 10.0 Critical
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.
Updated Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invocation of arbitrary methods or deserialization of untrusted types.
UpdatedBarracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
UpdatedThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordJumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is tr
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority. At the request of the MITRE TL-Root and following the CVE Program’s Dispute Policy, it has been determined that this assignment did not identify a valid vulnerability based on the vendor's product security model. Additionally, this assignment conflicts with an existing CVE (CVE-2023-48022).
Updated · Rejected recordUnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so without enforcing authentication or restricting path inputs. As a result, an unauthenticated remote
UpdatedThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordeGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt
UpdatedeGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the uploaded content to a shared upload helper, and store the file on the server under a framework-controlled p
UpdatedAudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new filename by combining a generated base name with the attacker-controlled extension portion of the origina
UpdatedAudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper va
UpdatedAudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts withi
Updated- CVE-2025-34332: AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE 8.5 High
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORIT
Updated - CVE-2025-34331: AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php 8.7 High
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request files stored on the appliance based solely on attacker-supplied path and filename parameters. While limi
Updated AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\F2MAdmin\\tmp directory using a filename derived from application constants,
Updated- CVE-2025-34329: AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php 9.3 Critical
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if it does not exist, and then moves an uploaded file to that location using the attacker
Updated - CVE-2025-34328: AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.php 9.3 Critical
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which ru
Updated This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordGoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network
UpdatedNagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to '/usr/local/nagioslogserver/scripts', while several scripts in this directory are owned by root and may be executed via sudo without a pa
UpdatedNagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without pro
UpdatedThis CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
Updated · Rejected recordBASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager; posses
UpdatedTOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi-bin/dns.cgi and the TLS hostname is provided in the TLS_HOSTNAME parameter
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txt_mailuser and txt_mailpass parameters when updating the mail server settings. When a user updates the mail server, the application issues an HTTP POST request to /cgi-bin/mail.cgi and the username and pass
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOG_ADDR parameter when updating the remote syslog server address. When a user updates the Remote logging Syslog server, the application issues an HTTP POST request to /cgi-bin/logs.cgi/config.dat and t
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation wit
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, D
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters when updating Quality of Service (QoS) settings. When a user updates speeds or classes, the application issues an HTTP POST request to /cgi-bin/qos.
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS host is added, the application issues an HTTP POST request to /cgi-bin/ddns.cgi and saves the values
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values displayed on the Time Server page are updated, the application issues an HTTP POST request to /cgi-bin/t
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the firewall country search defaults. When a user updates the default values for the firewall country search, the application issues an HTTP POST request to /cgi-bin/logs.cgi
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogip.dat with the default
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - for example, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_RE
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the IGNORE_ENTRY_REMARK parameter when adding a whitelisted host. When a whitelisted host is added, an HTTP POST request is sent to the Request-URI /cgi-bin/ids.cgi and the remark for the entry is provided in the
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST request with the ACTION parameter set to saveservice, and the protocol type is specified in the PROT
UpdatedIPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. When a user adds a new location group, the application issues an HTTP POST request with the ACTION parameter set to savelocationgrp, and the value of the CO
UpdatedA template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.
Updated