CVE-2025-61713

MediumCVSS 4.4/10Last modified Oct 18, 2026

Description

A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated attacker with read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-316

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-61729.8Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.CVE-2025-617237.5The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which p CVE-2025-617245.3The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a CVE-2025-617257.5The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-lite CVE-2025-617267.5The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is CVE-2025-617276.5An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a CVE-2025-617286.5archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to CVE-2025-617297.5Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furtherm CVE-2025-61737.2A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the CVE-2025-617305.3During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello a CVE-2025-617317.8Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. T CVE-2025-617328.6A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.