CVE-2025-15685

Publié : 12 août 2026

Modifié : 12 août 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation causes memory corruption. The attack is possible to be carried out remotely.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/open5gs/open5gs/https://github.com/open5gs/open5gs/issues/4156 https://vuldb.com/cve/CVE-2025-15685 https://vuldb.com/submit/867103 https://vuldb.com/vuln/387278 https://vuldb.com/vuln/387278/cti

Dernières Vulnérabilités

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.

VOIR DÉTAILS

CVE-2026-14859

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

VOIR DÉTAILS

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

VOIR DÉTAILS