Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: vtenext 25.02.2 Clear all filters
TI-2025-44012 CVE-2025-71456 · GHSA-7pcp-87fg-9mfg

SQL injection in VTENext Fax EditView exposes database contents

Priority HIGH 72

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00256 Published 2026-11-04 Fixed in 25.02.2 CWE-89
TI-2025-44011 CVE-2025-71455 · GHSA-rxq9-mwhc-2q96

vtenext Session Identifier Disclosure via Touch Web Service

Priority MEDIUM 60

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00338 Published 2026-11-04 Fixed in 25.02.2 CWE-200
TI-2025-44010 CVE-2025-71454 · GHSA-28g9-rxcj-4j2q

CSRF protection bypass in vtenext via non-POST requests

Priority MEDIUM 64

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00194 Published 2026-11-04 Fixed in 25.02.2 CWE-352
TI-2025-44009 CVE-2025-71453 · GHSA-44fg-83c3-2cjh

Reflected XSS in VTENext HomeWidgetBlockList via widgetInfoList

Priority LOW 23

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00243 Published 2026-11-04 Fixed in 25.02.2 CWE-79