In the dynamic realm of cybersecurity, staying updated on the latest vulnerabilities is imperative.
This edition of the AppSecWorld's CVE Daily Digest provides a snapshot of the vulnerabilities published in National Vulnerability Database between July 05-06, 2025.
During this period, The National Vulnerability Database published 68, and these new Common Vulnerabilities and Exposures (CVEs) are classified as follows:
Critical: 1
High: 3
Medium: 5
Low: 0
Severity Not Assigned: 59
Identifying and understanding these vulnerabilities are pivotal steps towards enhancing security measures and creating a safer digital environment.
Now, let's delve deeper into AppSecWorld's CVE Daily Digest, spotlighting the Critical and High Severity vulnerabilities that demand immediate attention.
1. CVE-2025-26850
Base Score: 9.3
Base Severity: CRITICAL
Exploitability Score: 2.5
Impact Score: 6.0
Description: The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
References: https://support.quest.com/kb/4378559/quest-response-to-kace-sma-agent-vulnerability-cve-2025-26850
CWE-ID: CWE-863
Common Platform Enumerations (CPE): Not Found
2. CVE-2025-43711
Base Score: 8.1
Base Severity: HIGH
Exploitability Score: 1.4
Impact Score: 6.0
Description: Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by dragging a crafted Tunnelblick.app file into /Applications.
References: https://tunnelblick.net/cCVE-2025-43711.html
https://tunnelblick.net/downloads.html
CWE-ID: CWE-459
Common Platform Enumerations (CPE): Not Found
3. CVE-2025-53603
Base Score: 7.5
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 3.6
Description: In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
References: https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790
https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2
https://github.com/Alinto/sope/pull/69
https://www.openwall.com/lists/oss-security/2025/07/02/3
CWE-ID: CWE-476
Common Platform Enumerations (CPE): Not Found
4. CVE-2025-47227
Base Score: 7.5
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 3.6
Description: In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
References: https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
https://www.scriptcase.net/changelog/
https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution
CWE-ID: CWE-684
Common Platform Enumerations (CPE): Not Found
This edition of the AppSecWorld's CVE Daily Digest provides a snapshot of the vulnerabilities published in National Vulnerability Database between July 05-06, 2025.
During this period, The National Vulnerability Database published 68, and these new Common Vulnerabilities and Exposures (CVEs) are classified as follows:
Critical: 1
High: 3
Medium: 5
Low: 0
Severity Not Assigned: 59
Identifying and understanding these vulnerabilities are pivotal steps towards enhancing security measures and creating a safer digital environment.
Now, let's delve deeper into AppSecWorld's CVE Daily Digest, spotlighting the Critical and High Severity vulnerabilities that demand immediate attention.
1. CVE-2025-26850
Base Score: 9.3
Base Severity: CRITICAL
Exploitability Score: 2.5
Impact Score: 6.0
Description: The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
References: https://support.quest.com/kb/4378559/quest-response-to-kace-sma-agent-vulnerability-cve-2025-26850
CWE-ID: CWE-863
Common Platform Enumerations (CPE): Not Found
2. CVE-2025-43711
Base Score: 8.1
Base Severity: HIGH
Exploitability Score: 1.4
Impact Score: 6.0
Description: Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by dragging a crafted Tunnelblick.app file into /Applications.
References: https://tunnelblick.net/cCVE-2025-43711.html
https://tunnelblick.net/downloads.html
CWE-ID: CWE-459
Common Platform Enumerations (CPE): Not Found
3. CVE-2025-53603
Base Score: 7.5
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 3.6
Description: In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
References: https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790
https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2
https://github.com/Alinto/sope/pull/69
https://www.openwall.com/lists/oss-security/2025/07/02/3
CWE-ID: CWE-476
Common Platform Enumerations (CPE): Not Found
4. CVE-2025-47227
Base Score: 7.5
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 3.6
Description: In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
References: https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
https://www.scriptcase.net/changelog/
https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution
CWE-ID: CWE-684
Common Platform Enumerations (CPE): Not Found