vtenext has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was November 2026 with 5. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2025-71457Critical· 9.8vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php66CVE-2025-71456High· 8.1vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView57CVE-2025-71454Medium· 6.5vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering48CVE-2025-71455Medium· 5.3vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service41CVE-2025-71453Medium· 6.1vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList34
vtenext vulnerabilities
CVEs affecting vtenext, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2025-71457Critical· 9.8PoCvtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send a…
CVE-2025-71456High· 8.1PoCvtenext before 25.02.2 SQL Injection via fieldname in Fax EditView
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database con…
CVE-2025-71455Medium· 5.3PoCvtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as throu…
CVE-2025-71453Medium· 6.1vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to…
CVE-2025-71454Medium· 6.5PoCvtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted…