CVE-2025-48928

MediumCVSS 4.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-528CWE-552

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 1, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-489299.8The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiratCVE-2025-48936.3A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01CVE-2025-489305.3The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to aCVE-2025-489315.5The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainboCVE-2025-489345.3Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any vCVE-2025-489359.1Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass DCVE-2025-489368.8Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in CVE-2025-489374.9matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does CVE-2025-489389.8go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versionsCVE-2025-489394.2tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js whCVE-2025-48945.9A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulneCVE-2025-489407.2MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which all