Skip to content
OpenAdvisories

Vendor

vtenext

5 known vulnerabilities.

Products

vtenext 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-71455

    vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service

    vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scriptin…

    vtenext vtenext
  • Medium 6.5
    CVE-2025-71454

    vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering

    vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-ch…

    vtenext vtenext
  • Medium 6.1
    CVE-2025-71453

    vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList

    vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST…

    vtenext vtenext