PT-2025-16262 · Avantfax+1 · Avantfax+1

Fabian Beskow · Publicado 2025-02-21 · Atualizado 2026-05-26 · CVE-2025-1782

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HylaFAX Enterprise Web Interface and AvantFAX (affected versions not specified)

Description The language form element in HylaFAX Enterprise Web Interface and AvantFAX is not properly sanitized before being used, allowing an attacker to include an arbitrary file in the PHP code. This enables the attacker to perform any action as the web server user. The flaw requires the attacker to be authenticated with a valid user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2025-09789

CVE-2025-1782

Produtos afetados

Avantfax

Hylafax Enterprise Web Interface

Referências · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-1782 · Nota de Segurança
• https://twitter.com/CCBalert/status/1912165241099542699 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1912423384580759856 · Publicação no Twitter
• https://twitter.com/TweetThreatNews/status/1913160969292759320 · Publicação no Twitter
• https://vuldb.com/?id.304656 · Nota
• https://twitter.com/syedaquib77/status/1912335955085709675 · Publicação no Twitter
• https://ifax.com/security/CVE-2025-1782.html · Nota
• https://t.me/cvetracker/21559 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1911857689841279080 · Publicação no Twitter
• https://t.me/cvedetector/22885 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1911854983227822498 · Publicação no Twitter
• https://t.me/cveNotify/164737 · Publicação no Telegram
• https://t.me/purp_sec/614 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-09789 · Nota de Segurança