CVE-2025-57795
CriticalSummary
Wersje Explorance Blue przed 8.14.13 zawierają podatność na zdalne pobieranie plików, która wymaga uwierzytelnienia w komponencie usługi internetowej. W domyślnych konfiguracjach, luka ta może być wykorzystana do zdalnego wykonania kodu.
Risk Assessment
Organizacje mogą być narażone na zdalne wykonanie kodu, co może prowadzić do przejęcia kontroli nad systemem i wycieku danych. To stwarza poważne zagrożenie dla bezpieczeństwa infrastruktury IT.
Recommendation
Zaleca się aktualizację do wersji 8.14.13 lub nowszej, aby usunąć tę podatność. Dodatkowo, warto przeprowadzić audyt konfiguracji zabezpieczeń usług internetowych.
Related vulnerabilities
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66565Critical
The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66564Critical
The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS