PT-2025-40350 · Rocketsoftware · Trufusion Enterprise

Published 2025-10-02 · Updated 2025-10-27 · CVE-2025-27225

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TRUfusion Enterprise versions through 7.10.4.0

Description TRUfusion Enterprise through version 7.10.4.0 has an endpoint, /trufusionPortal/jsp/internal admin contact login.jsp, accessible to unauthenticated users. This allows attackers to access sensitive internal information, including Personally Identifiable Information (PII).

Recommendations Versions prior to 7.10.4.0 should be updated.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-27225

Affected Products

Trufusion Enterprise

References · 7

• 🔥 https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt · Exploit
• 🔥 https://rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27225 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27225 · Vendor Advisory
• https://rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Note
• https://t.me/CVEtracker/35867 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1973674354513776931 · Twitter Post