Vulnerability intelligence

CVE-2025-64328 identifies a command injection vulnerability within the FreePBX Endpoint Manager module. Specifically, the flaw resides in the `check_ssh_connect()` function of the Filestore component. This post-authentication vulnerability allows an authenticated attacker to execute arbitrary shell commands as the `asterisk` user on the affected system. This vulnerability impacts FreePBX Endpoint Manager versions 17.0.2.36 and above, prior to version 17.0.3. Reports indicate that a financially motivated hacker group, INJ3CTOR3, has actively exploited CVE-2025-64328 since early December 2025 to deploy a persistent webshell known as "EncystPHP," enabling them to gain administrative control over compromised VoIP systems.

CVE-2025-5959 is a type confusion vulnerability affecting the V8 JavaScript engine in Google Chrome versions prior to 137.0.7151.103. This flaw can be exploited by a remote attacker who crafts a malicious HTML page. The vulnerability was reported by Seunghyun Lee as part of TyphoonPWN 2025. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the browser's sandbox. To mitigate this vulnerability, users are advised to update their Chrome browsers to version 137.0.7151.103 or later.

CVE-2025-40552 is an authentication bypass vulnerability affecting SolarWinds Web Help Desk. This flaw allows a remote, unauthenticated attacker to circumvent the application's access controls. By exploiting CVE-2025-40552, an attacker can execute actions and methods within the Web Help Desk application that are typically restricted to authenticated users, potentially gaining broad control over the application.

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

CVE-2025-68461 is a Cross-Site Scripting (XSS) vulnerability affecting Roundcube Webmail versions before 1.5.12 and 1.6 before 1.6.12. The vulnerability is caused by improper neutralization of input during web page generation, specifically through the `animate` tag in SVG documents. This vulnerability allows an attacker to inject malicious JavaScript code that executes in the victim's browser when viewing crafted SVG content within the webmail interface. The vulnerability can be exploited over a network without requiring any privileges or user interaction.