Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2025-71457 (GCVE-0-2025-71457)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:25

Title

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

Summary

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:25 UTC

CWE

CWE-620 - Unverified Password Change

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://blog.sicuranext.com/vtenext-25-02-a-three…	third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way…	technical-description
https://usermanual.vtenext.com/books/release-note…	release-notes
https://www.vulncheck.com/advisories/vtenext-25.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vtenext	vtenext	Affected: 25.02 , < 25.02.1 (custom) cpe:2.3:a:vtenext:vtenext::::::::

Date Public

2025-08-12 00:00

Credits

Mattia "0xbro" Brollo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71457",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:25:00.929154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:25:20.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vtenext",
          "vendor": "vtenext",
          "versions": [
            {
              "lessThan": "25.02.1",
              "status": "affected",
              "version": "25.02",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.02.1",
                  "versionStartIncluding": "25.02",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mattia \"0xbro\" Brollo"
        }
      ],
      "datePublic": "2025-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:45.211Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note"
        },
        {
          "name": "VulnCheck Advisory: vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php"
        }
      ],
      "title": "vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71457",
    "datePublished": "2026-11-04T20:36:45.211Z",
    "dateReserved": "2026-11-04T20:21:24.842Z",
    "dateUpdated": "2026-11-05T19:25:20.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71456 (GCVE-0-2025-71456)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:24

Title

vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView

Summary

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:24 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://blog.sicuranext.com/vtenext-25-02-a-three…	third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way…	technical-description
https://usermanual.vtenext.com/books/release-note…	release-notes
https://www.vulncheck.com/advisories/vtenext-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vtenext	vtenext	Affected: 0 , < 25.02.2 (custom) cpe:2.3:a:vtenext:vtenext::::::::

Date Public

2025-08-12 00:00

Credits

Mattia "0xbro" Brollo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71456",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:24:36.654277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:24:44.377Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vtenext",
          "vendor": "vtenext",
          "versions": [
            {
              "lessThan": "25.02.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.02.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mattia \"0xbro\" Brollo"
        }
      ],
      "datePublic": "2025-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:44.526Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"
        },
        {
          "name": "VulnCheck Advisory: vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-sql-injection-via-fieldname-in-fax-editview"
        }
      ],
      "title": "vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71456",
    "datePublished": "2026-11-04T20:36:44.526Z",
    "dateReserved": "2026-11-04T20:21:24.482Z",
    "dateUpdated": "2026-11-05T19:24:44.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71455 (GCVE-0-2025-71455)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:24

Title

vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service

Summary

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:23 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://blog.sicuranext.com/vtenext-25-02-a-three…	third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way…	technical-description
https://usermanual.vtenext.com/books/release-note…	release-notes
https://www.vulncheck.com/advisories/vtenext-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vtenext	vtenext	Affected: 0 , < 25.02.2 (custom) cpe:2.3:a:vtenext:vtenext::::::::

Date Public

2025-08-12 00:00

Credits

Mattia "0xbro" Brollo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71455",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:23:26.787003Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:24:04.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vtenext",
          "vendor": "vtenext",
          "versions": [
            {
              "lessThan": "25.02.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.02.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mattia \"0xbro\" Brollo"
        }
      ],
      "datePublic": "2025-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:43.841Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"
        },
        {
          "name": "VulnCheck Advisory: vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"
        }
      ],
      "title": "vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71455",
    "datePublished": "2026-11-04T20:36:43.841Z",
    "dateReserved": "2026-11-04T20:21:24.134Z",
    "dateUpdated": "2026-11-05T19:24:04.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71454 (GCVE-0-2025-71454)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:06

Title

vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering

Summary

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:05 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://blog.sicuranext.com/vtenext-25-02-a-three…	third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way…	technical-description
https://usermanual.vtenext.com/books/release-note…	release-notes
https://www.vulncheck.com/advisories/vtenext-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vtenext	vtenext	Affected: 0 , < 25.02.2 (custom) cpe:2.3:a:vtenext:vtenext::::::::

Date Public

2025-08-12 00:00

Credits

Mattia "0xbro" Brollo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71454",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:05:52.954478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:06:36.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vtenext",
          "vendor": "vtenext",
          "versions": [
            {
              "lessThan": "25.02.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.02.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mattia \"0xbro\" Brollo"
        }
      ],
      "datePublic": "2025-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:43.148Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"
        },
        {
          "name": "VulnCheck Advisory: vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-csrf-protection-bypass-via-http-method-tampering"
        }
      ],
      "title": "vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71454",
    "datePublished": "2026-11-04T20:36:43.148Z",
    "dateReserved": "2026-11-04T20:21:23.788Z",
    "dateUpdated": "2026-11-05T19:06:36.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71453 (GCVE-0-2025-71453)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:14

Title

vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList

Summary

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:14 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://blog.sicuranext.com/vtenext-25-02-a-three…	third-party-advisoryexploit
https://0xbro.red/posts/vtenext-25-02-a-three-way…	technical-description
https://usermanual.vtenext.com/books/release-note…	release-notes
https://www.vulncheck.com/advisories/vtenext-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
vtenext	vtenext	Affected: 0 , < 25.02.2 (custom) cpe:2.3:a:vtenext:vtenext::::::::

Date Public

2025-08-12 00:00

Credits

Mattia "0xbro" Brollo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71453",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:14:17.919932Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:14:26.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vtenext",
          "vendor": "vtenext",
          "versions": [
            {
              "lessThan": "25.02.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.02.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mattia \"0xbro\" Brollo"
        }
      ],
      "datePublic": "2025-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim\u0027s vtenext session."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:42.460Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"
        },
        {
          "name": "VulnCheck Advisory: vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"
        }
      ],
      "title": "vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71453",
    "datePublished": "2026-11-04T20:36:42.460Z",
    "dateReserved": "2026-11-04T20:21:23.427Z",
    "dateUpdated": "2026-11-05T19:14:26.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

5 vulnerabilities by vtenext

CVE-2025-71457 (GCVE-0-2025-71457)

CVE-2025-71456 (GCVE-0-2025-71456)

CVE-2025-71455 (GCVE-0-2025-71455)

CVE-2025-71454 (GCVE-0-2025-71454)

CVE-2025-71453 (GCVE-0-2025-71453)