NetFax Server
by MICi
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-48047 | Cri | 0.62 | — | 0.16 | May 29, 2025 | An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint. | ||
| CVE-2025-48045 | Hig | 0.57 | — | 0.01 | May 29, 2025 | An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials. | ||
| CVE-2025-48046 | Med | 0.34 | — | 0.01 | May 29, 2025 | An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint. |
- risk 0.62cvss —epss 0.16
An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.
- risk 0.57cvss —epss 0.01
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
- risk 0.34cvss —epss 0.01
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.