CVE-2025-54559
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An issue was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 that allows remote Path Traversal for loading arbitrary external content. An attacker could read or load files outside the intended directory.
Risk Assessment
This may lead to disclosure of sensitive files or loading malicious content into the application. The vulnerability increases the risk of further system exploitation.
Recommendation
Update Desktop Alert PingAlert to a version later than 6.1.1.2 or apply the vendor patch. Implement path validation and restrict access to allowed directories.
Other vulnerabilities in Desktop Alert PingAlert
See all- CVE-2025-54347Critical
In Application Server of Desktop Alert PingAlert (versions 6.1.0.11 to 6.1.1.2), a Directory Traversal vulnerability allows an attacker to write arbitrary files under certain conditions.
- CVE-2025-54343Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
- CVE-2025-54339Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It is remotely exploitable for escalation of privileges.
- CVE-2025-54563High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
- CVE-2025-54341Medium
Hard-coded configuration values exist in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. This may lead to disclosure of sensitive information or facilitate exploitation by attackers.
- CVE-2025-54338High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
- CVE-2025-54562Medium
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows technical information to be disclosed through stack traces.
- CVE-2025-54561Medium
An Incorrect Access Control vulnerability in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 allows remote access to content without proper permissions due to a Broken Authorization Schema.
- CVE-2025-54560Low
A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows probing of internal infrastructure.
- CVE-2025-54348Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows an attacker to hijack a user's browser and capture sensitive information.
Original NVD description (English source)
An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS