CVE-2025-11371High· 7.5▾ Abyssal⚠ Exploited in the wildPoC availableIn the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been obser…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 41.3 · likelihood 18.4 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Nov 25, 2025
92%
Last analysed / modified upstream
3 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Nov 4, 2025. Federal remediation due Nov 25, 2025. View catalog ↗
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
centrestack < 16.10.10408.56683triofox <= 16.7.10368.56560Upgrade past the affected range:
centrestack 16.10.10408.56683Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14611Critical· 9.8Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme
CVE-2026-21589Critical· 9.3This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
CVE-2026-114400Medium· 5.9Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
CVE-2026-112144Medium· 5.3satya-vinay Events-Management-System project.sql file access
CVE-2025-15153Low· 3.7A weakness has been identified in PbootCMS up to 3.2.12
CVE-2026-108938Medium· 5.3A flaw has been found in code-projects Matrimonial System 1.0