CVE-2025-54563
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
Risk Assessment
An attacker may access information they are not authorized to see, potentially resulting in leakage of sensitive data. The risk affects organizations using vulnerable PingAlert versions.
Recommendation
Update Desktop Alert PingAlert to a version later than 6.1.1.2 or apply the vendor-provided fix. Verify access control configuration in the application server.
Other vulnerabilities in Desktop Alert PingAlert
See all- CVE-2025-54347Critical
In Application Server of Desktop Alert PingAlert (versions 6.1.0.11 to 6.1.1.2), a Directory Traversal vulnerability allows an attacker to write arbitrary files under certain conditions.
- CVE-2025-54343Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
- CVE-2025-54339Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It is remotely exploitable for escalation of privileges.
- CVE-2025-54341Medium
Hard-coded configuration values exist in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. This may lead to disclosure of sensitive information or facilitate exploitation by attackers.
- CVE-2025-54338High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
- CVE-2025-54562Medium
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows technical information to be disclosed through stack traces.
- CVE-2025-54561Medium
An Incorrect Access Control vulnerability in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 allows remote access to content without proper permissions due to a Broken Authorization Schema.
- CVE-2025-54560Low
A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows probing of internal infrastructure.
- CVE-2025-54559Low
An issue was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 that allows remote Path Traversal for loading arbitrary external content. An attacker could read or load files outside the intended directory.
- CVE-2025-54348Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows an attacker to hijack a user's browser and capture sensitive information.
Original NVD description (English source)
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS