CVE-2025-13651

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
Microcom	ZeusWeb	6.1.31

References

https://www.hackrtu.com/blog/CNA-CVE-2025-13651/Third Party Advisory
https://www.hackrtu.com/blog/CNA-HRTU-0001/Third Party Advisory
https://www.microcom360.com/servicio-zeus-web/Product
https://zeus.microcom.es:4040/Permissions Required

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136526.5The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, a CVE-2025-136534.3In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated CVE-2025-136547.5A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to tr CVE-2025-136566.4The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions u CVE-2025-136574.3The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This CVE-2025-136589.3A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the CVE-2025-136598.8Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic CVE-2025-13667.8A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function st CVE-2025-136605.3The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the pl CVE-2025-136618.0Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs CVE-2025-136627.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 CVE-2025-136636.7Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation d