Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Vtenext CVE-2025-71457
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.p
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Vtenext CVE-2025-71456
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname par
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Vtenext CVE-2025-71455
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web servic
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Vtenext CVE-2025-71454
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation f
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Vtenext CVE-2025-71453
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys fro
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit