CVE-2025-27225
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. T
CVSS
7.5
Alta
EPSS
19.8%
p97
KEV
—
Exploit Today
29
0-100
Publicado: 27 de out. de 2025 · Última mod.: 5 de nov. de 2026 · CWE-200
18.4%EPSS · 30 dias19.8%
2026-10-142026-11-11
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
- github.comhttps://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
- www.rcesecurity.comhttps://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
- www.rocketsoftware.comhttps://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
- github.comhttps://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-126920——
———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-126882——
———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-126878——
———Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-126327——
———Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.7hCVE-2026-0331——
———An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface.
Panorama is not affected by this vulnerability.9hCVE-2026-575006.3 MÉD—
———REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.10h