Threat database

CVE-2025-13698 is a medium-severity path traversal vulnerability in Deciso OPNsense version 25.7, specifically in the diag_backup.php component. It allows an authenticated network-adjacent attacker to create arbitrary files with root privileges by exploiting improper validation of user-supplied file paths. The vulnerability does not impact confidentiality or availability but can severely affect system integrity. Exploitation requires high privileges (authentication) but no user interaction. There are no known exploits in the wild currently. European organizations using OPNsense 25.7, especially those in critical infrastructure or government sectors, should prioritize patching or mitigating this issue. Mitigations include strict input validation, restricting file write permissions, and monitoring for unusual file creation activities.

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

Gibbon before 29.0.00 allows CSRF.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1 - 1010.

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.