CVE-2025-68392Medium· 5.1▾ SunlitARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in: PROTECTELMAJ v6.5.19…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
PROTECTELMAJ < 6.5.19BDF < 6.4.67Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68391Medium· 5.3Arbitrary File Upload in Protectel
CVE-2025-68395Medium· 5.1Stored XSS in Protectel
CVE-2025-68394High· 8.4SQL Injection in Protectel
CVE-2025-68393High· 8.4SQL Injection in Protectel
CVE-2025-67740Low· 2.7In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
CVE-2020-3578Medium· 5.3A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and ac…