CVE-2025-71260

HighCVSS 8.8/10Last modified Aug 6, 2026

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
BMC Software, Inc.FootPrints>= 20.20.02, <= 20.24.01.001

References

Timeline

Published
Mar 19, 2026
Last modified
Aug 6, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-712618.6An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere wiCVE-2025-712637.8In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size oCVE-2025-712645.3Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).CVE-2025-712655.5In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent meCVE-2025-712665.5In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We fCVE-2025-712675.5In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We founCVE-2025-712685.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline eCVE-2025-712695.5In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOCVE-2025-71277.2A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown pCVE-2025-712705.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable exception fixup for specific ADE subcode This patch CVE-2025-712715.5In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was coCVE-2025-712725.5In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths T
CVE-2025-71260: High severity, CVSS 8.8 | Vulnix