First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-6239

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Zohocorp	ManageEngine Applications Manager	<= 176800

References

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-6239.htmlVendor Advisory

Timeline

Published: Oct 21, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-623906.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data CVE-2025-623916.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data CVE-2025-623926.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data CVE-2025-623934.3A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized CVE-2025-623944.3Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive q CVE-2025-623954.3A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system contex CVE-2025-623965.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP h CVE-2025-623975.3The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissanc CVE-2025-623985.4A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, poten CVE-2025-623997.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible t CVE-2025-62405.0Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profis CVE-2025-624006.5Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could re

CVE-2025-6239: Medium severity, CVSS 6.5 | Vulnix