Vulnerability-Lookup

CVE-2025-1782 (GCVE-0-2025-1782)

Vulnerability from cvelistv5 – Published: 2025-04-14 18:41 – Updated: 2025-04-30 17:09

Red Hat Product Security has come to the conclusion that this CVE is not needed.

Show details on NVD website

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-04-30T17:09:06.754Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "Red Hat Product Security has come to the conclusion that this CVE is not needed."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-1782",
    "datePublished": "2025-04-14T18:41:21.745Z",
    "dateRejected": "2025-04-30T17:09:06.754Z",
    "dateReserved": "2025-02-28T15:49:58.508Z",
    "dateUpdated": "2025-04-30T17:09:06.754Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-1782\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-04-14T19:15:36.277\",\"lastModified\":\"2025-04-30T18:15:37.500\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"Red Hat Product Security has come to the conclusion that this CVE is not needed.\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2025-04-30T17:09:06.754Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-1782\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"REJECTED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2025-02-28T15:49:58.508Z\", \"datePublished\": \"2025-04-14T18:41:21.745Z\", \"dateUpdated\": \"2025-04-30T17:09:06.754Z\", \"dateRejected\": \"2025-04-30T17:09:06.754Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-1782

Vulnerability from fkie_nvd - Published: 2025-04-14 19:15 - Updated: 2025-04-30 18:15

Severity ?

Summary

Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed."
    }
  ],
  "id": "CVE-2025-1782",
  "lastModified": "2025-04-30T18:15:37.500",
  "metrics": {},
  "published": "2025-04-14T19:15:36.277",
  "references": [],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Rejected"
}

GHSA-QX93-7WX9-6WP7

Vulnerability from github – Published: 2025-04-14 21:32 – Updated: 2025-04-14 21:32

Details

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.

Severity ?

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-1782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-14T19:15:36Z",
    "severity": "CRITICAL"
  },
  "details": "In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized \nbefore being used and can be misused to include an arbitrary file in the\n PHP code allowing an attacker to do anything as the web server user. \nThis flaw requires the attacker to be authenticated with a valid user account.",
  "id": "GHSA-qx93-7wx9-6wp7",
  "modified": "2025-04-14T21:32:24Z",
  "published": "2025-04-14T21:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1782"
    },
    {
      "type": "WEB",
      "url": "https://www.ifax.com/security/CVE-2025-1782.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-1782 (GCVE-0-2025-1782)

FKIE_CVE-2025-1782

GHSA-QX93-7WX9-6WP7

Tags

Sightings

Nomenclature