Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11 vulnerabilities by blesta
GCVE-1988-2026-0233
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:33
VLAI
EPSS
VEX
Title
[KIS-2026-03] Blesta <= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities
Summary
--------------------------------------------------------------------------
Blesta <= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities
--------------------------------------------------------------------------
[-] Software Link:
https://www.blesta.com
[-] Affected Versions:
All versions from 3.0.0 to 5.13.1.
[-] Vulnerabilities Description:
The vulnerabilities exist because user input passed through the
"invoices" POST parameter or the "item-ext-ref" GET parameter when
dispatching the Checkout2::validate() or Checkout2::success() method
is not properly sanitized before being used in a call to the
unserialize() PHP function. This can be exploited by malicious client
users to inject arbitrary PHP objects into the application scope,
allowing them to perform a variety of attacks, such as executing
arbitrary PHP code (RCE).
Successful exploitation of this issue requires the 2Checkout payment
gateway to be installed.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-25614.php
[-] Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
[-] Disclosure Timeline:
[19/01/2026] - Vendor notified
[22/01/2026] - CVE identifier requested
[28/01/2026] - Version 5.13.2 released
[31/01/2026] - Version 5.13.3 released to address regressions
introduced in 5.13.2
[03/02/2026] - CVE identifier assigned
[04/02/2026] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has
assigned the name CVE-2026-25614 to these vulnerabilities.
[-] Credits:
Vulnerabilities discovered by Egidio Romano.
[-] Other References:
https://www.blesta.com/2026/01/28/security-advisory/
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-03
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0233 (this record)
- related CVE-2026-25614
{
"containers": {
"cna": {
"affected": [
{
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "--------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities\n--------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.0.0 to 5.13.1.\n\n\n[-] Vulnerabilities Description:\n\nThe vulnerabilities exist because user input passed through the\n\"invoices\" POST parameter or the \"item-ext-ref\" GET parameter when\ndispatching the Checkout2::validate() or Checkout2::success() method\nis not properly sanitized before being used in a call to the\nunserialize() PHP function. This can be exploited by malicious client\nusers to inject arbitrary PHP objects into the application scope,\nallowing them to perform a variety of attacks, such as executing\narbitrary PHP code (RCE).\n\nSuccessful exploitation of this issue requires the 2Checkout payment\ngateway to be installed.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-25614.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25614 to these vulnerabilities.\n\n\n[-] Credits:\n\nVulnerabilities discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-03\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:33:08Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/2"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/2"
},
{
"url": "https://karmainsecurity.com/KIS-2026-03"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-25614.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.blesta.com"
},
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/2"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-03] Blesta \u003c= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-25614",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0233",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/2",
"automated": true,
"contentSha256": "e59e4af7234ed5bfb95dc060e157dcf0886b0270a699741bf257fecbdc07394a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/2",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-04T10:50:59Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0233"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T13:33:08Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0233"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0232
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:33
VLAI
EPSS
VEX
Title
[KIS-2026-02] Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities
Summary
--------------------------------------------------------------------------------
Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities
--------------------------------------------------------------------------------
[-] Software Link:
https://www.blesta.com
[-] Affected Versions:
All versions from 3.0.0 to 5.13.1.
[-] Vulnerabilities Description:
The vulnerabilities exist because user input passed through the "vars"
and "order_info" POST parameters when dispatching the
/app/controllers/admin_clients.php script, and through the
"$group_name" POST parameter when dispatching the
/app/controllers/admin_company_groups.php script, is not properly
sanitized before being used in a call to the unserialize() PHP
function. This can be exploited by malicious administrator users to
inject arbitrary PHP objects into the application scope, allowing them
to perform a variety of attacks, such as executing arbitrary PHP code
(RCE).
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-25615.php
[-] Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
[-] Disclosure Timeline:
[19/01/2026] - Vendor notified
[20/01/2026] - Vendor response stating: “this issue was previously
identified during an internal security review”
[22/01/2026] - CVE identifier requested
[28/01/2026] - Version 5.13.2 released
[31/01/2026] - Version 5.13.3 released to address regressions
introduced in 5.13.2
[03/02/2026] - CVE identifier assigned
[04/02/2026] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has
assigned the name CVE-2026-25615 to these vulnerabilities.
[-] Credits:
Vulnerabilities discovered by Egidio Romano.
[-] Other References:
https://www.blesta.com/2026/01/28/security-advisory/
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-02
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
reference
GCVE-1988-2026-0232 (this record)
- related CVE-2026-25615
{
"containers": {
"cna": {
"affected": [
{
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "--------------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities\n--------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.0.0 to 5.13.1.\n\n\n[-] Vulnerabilities Description:\n\nThe vulnerabilities exist because user input passed through the \"vars\"\nand \"order_info\" POST parameters when dispatching the\n/app/controllers/admin_clients.php script, and through the\n\"$group_name\" POST parameter when dispatching the\n/app/controllers/admin_company_groups.php script, is not properly\nsanitized before being used in a call to the unserialize() PHP\nfunction. This can be exploited by malicious administrator users to\ninject arbitrary PHP objects into the application scope, allowing them\nto perform a variety of attacks, such as executing arbitrary PHP code\n(RCE).\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-25615.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[20/01/2026] - Vendor response stating: \u201cthis issue was previously\nidentified during an internal security review\u201d\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25615 to these vulnerabilities.\n\n\n[-] Credits:\n\nVulnerabilities discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-02\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:33:05Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/1"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/1"
},
{
"url": "https://karmainsecurity.com/KIS-2026-02"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-25615.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.blesta.com"
},
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/1"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-02] Blesta \u003c= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-25615",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0232",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/1",
"automated": true,
"contentSha256": "eee9128de95a12c9f564f8113749453fecbf7cb9d328e5e8de184a4ce1f857a5",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/1",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-04T10:49:40Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0232"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T13:33:05Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0232"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0231
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:33
VLAI
EPSS
VEX
Title
[KIS-2026-01] Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability
Summary
---------------------------------------------------------------------------
Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability
---------------------------------------------------------------------------
[-] Software Link:
https://www.blesta.com
[-] Affected Versions:
All versions from 3.2.0 to 5.13.1.
[-] Vulnerability Description:
User input passed through the "confirm_url" GET parameter to the
/dialog/confirm and /client_dialog/confirm/ endpoints is not properly
sanitized before being used to generate HTML output; specifically,
before being used as action attribute of an HTML form. This can be
exploited by attackers to perform 2-clicks Reflected Cross-Site
Scripting (XSS) attacks.
[-] Proof of Concept:
An attacker may trick a victim Blesta user into clicking on links like these:
http://[blesta]/dialog/confirm/?confirm_url=javascript:alert('XSS')
http://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob('YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik='))
When the victim user clicks on the malicious link and then they also
click on the "Yes" button, the form will be submitted, and the
attacker-controlled JavaScript code will be executed on the victim
user's browser.
[-] Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
[-] Disclosure Timeline:
[19/01/2026] - Vendor notified
[22/01/2026] - CVE identifier requested
[28/01/2026] - Version 5.13.2 released
[31/01/2026] - Version 5.13.3 released to address regressions
introduced in 5.13.2
[03/02/2026] - CVE identifier assigned
[04/02/2026] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has
assigned the name CVE-2026-25616 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Other References:
https://www.blesta.com/2026/01/28/security-advisory/
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-01
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0231 (this record)
- related CVE-2026-25616
{
"containers": {
"cna": {
"affected": [
{
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------------\nBlesta \u003c= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.blesta.com\n\n\n[-] Affected Versions:\n\nAll versions from 3.2.0 to 5.13.1.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"confirm_url\" GET parameter to the\n/dialog/confirm and /client_dialog/confirm/ endpoints is not properly\nsanitized before being used to generate HTML output; specifically,\nbefore being used as action attribute of an HTML form. This can be\nexploited by attackers to perform 2-clicks Reflected Cross-Site\nScripting (XSS) attacks.\n\n\n[-] Proof of Concept:\n\nAn attacker may trick a victim Blesta user into clicking on links like these:\n\nhttp://[blesta]/dialog/confirm/?confirm_url=javascript:alert(\u0027XSS\u0027)\nhttp://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob(\u0027YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik=\u0027))\n\nWhen the victim user clicks on the malicious link and then they also\nclick on the \"Yes\" button, the form will be submitted, and the\nattacker-controlled JavaScript code will be executed on the victim\nuser\u0027s browser.\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 5.13.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Vendor notified\n\n[22/01/2026] - CVE identifier requested\n\n[28/01/2026] - Version 5.13.2 released\n\n[31/01/2026] - Version 5.13.3 released to address regressions\nintroduced in 5.13.2\n\n[03/02/2026] - CVE identifier assigned\n\n[04/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has\nassigned the name CVE-2026-25616 to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Other References:\n\nhttps://www.blesta.com/2026/01/28/security-advisory/\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-01\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:33:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/0"
},
{
"url": "https://karmainsecurity.com/KIS-2026-01"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.blesta.com"
},
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/0"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-01] Blesta \u003c= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-25616",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0231",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/0",
"automated": true,
"contentSha256": "f8b50e10b96c70923c07d3f0fe014dbc4bb1cadf852eaf8ee4664f764af8daf3",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-04T10:47:47Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0231"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T13:33:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0231"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25616 (GCVE-0-2026-25616)
Vulnerability from nvd – Published: 2026-02-03 19:21 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:47 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:47:12.876403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:47:19.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:50.117Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:31:39.024Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25616",
"datePublished": "2026-02-03T19:21:14.440Z",
"dateReserved": "2026-02-03T19:21:14.218Z",
"dateUpdated": "2026-02-05T06:19:50.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25615 (GCVE-0-2026-25615)
Vulnerability from nvd – Published: 2026-02-03 19:18 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:54 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:54:51.760694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:54:58.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:48.805Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:31:18.017Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25615",
"datePublished": "2026-02-03T19:18:47.837Z",
"dateReserved": "2026-02-03T19:18:47.567Z",
"dateUpdated": "2026-02-05T06:19:48.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25614 (GCVE-0-2026-25614)
Vulnerability from nvd – Published: 2026-02-03 19:16 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:57 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:57:38.653971Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:57:45.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:47.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:30:51.821Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25614",
"datePublished": "2026-02-03T19:16:43.188Z",
"dateReserved": "2026-02-03T19:16:42.910Z",
"dateUpdated": "2026-02-05T06:19:47.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-25859 (GCVE-0-2024-25859)
Vulnerability from nvd – Published: 2024-02-28 00:00 – Updated: 2024-08-28 15:33
VLAI
EPSS
VEX
Summary
A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-28 15:26 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:52:06.101Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.blesta.com/2024/02/08/security-advisory/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:blesta:blesta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "blesta",
"vendor": "blesta",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-25859",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T15:26:16.185703Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T15:33:13.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-28T20:03:24.539Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2024/02/08/security-advisory/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-25859",
"datePublished": "2024-02-28T00:00:00.000Z",
"dateReserved": "2024-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-28T15:33:13.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-25616 (GCVE-0-2026-25616)
Vulnerability from cvelistv5 – Published: 2026-02-03 19:21 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:47 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:47:12.876403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:47:19.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:50.117Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:31:39.024Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25616",
"datePublished": "2026-02-03T19:21:14.440Z",
"dateReserved": "2026-02-03T19:21:14.218Z",
"dateUpdated": "2026-02-05T06:19:50.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25615 (GCVE-0-2026-25615)
Vulnerability from cvelistv5 – Published: 2026-02-03 19:18 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:54 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:54:51.760694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:54:58.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:48.805Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:31:18.017Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25615",
"datePublished": "2026-02-03T19:18:47.837Z",
"dateReserved": "2026-02-03T19:18:47.567Z",
"dateUpdated": "2026-02-05T06:19:48.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25614 (GCVE-0-2026-25614)
Vulnerability from cvelistv5 – Published: 2026-02-03 19:16 – Updated: 2026-02-05 06:19
VLAI
EPSS
VEX
Summary
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-03 20:57 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T20:57:38.653971Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:57:45.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-05T06:19:47.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Feb/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blesta",
"vendor": "Blesta",
"versions": [
{
"lessThan": "5.13.3",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:30:51.821Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2026/01/28/security-advisory/"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-25614",
"datePublished": "2026-02-03T19:16:43.188Z",
"dateReserved": "2026-02-03T19:16:42.910Z",
"dateUpdated": "2026-02-05T06:19:47.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-25859 (GCVE-0-2024-25859)
Vulnerability from cvelistv5 – Published: 2024-02-28 00:00 – Updated: 2024-08-28 15:33
VLAI
EPSS
VEX
Summary
A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-28 15:26 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:52:06.101Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.blesta.com/2024/02/08/security-advisory/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:blesta:blesta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "blesta",
"vendor": "blesta",
"versions": [
{
"lessThan": "5.9.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-25859",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T15:26:16.185703Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T15:33:13.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-28T20:03:24.539Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.blesta.com/2024/02/08/security-advisory/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-25859",
"datePublished": "2024-02-28T00:00:00.000Z",
"dateReserved": "2024-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-28T15:33:13.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}