CVE-2025-34045 – WeiPHP WeChat Public Account Path Traversal Vulnerability

June 26, 2025

CVE ID : CVE-2025-34045

Published : June 26, 2025, 4:15 p.m. | 51 minutes ago

Description : A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-34047 – Leadsec SSL VPN Path Traversal Vulnerability

Next Article CVE-2025-34042 – Beward N100 IP Camera Command Injection Vulnerability

Highlights

CVE-2025-47713 – Apache CloudStack Domain Admin Privilege Escalation Vulnerability

June 10, 2025

CVE ID : CVE-2025-47713

Published : June 10, 2025, 11:15 p.m. | 2 hours, 34 minutes ago

Description : A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.

Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:
* Strict validation on Role Type hierarchy: the caller’s user-account role must be equal to or higher than the target user-account’s role.
* API privilege comparison: the caller must possess all privileges of the user they are operating on.
* Two new domain-level settings (restricted to the default Admin):
- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: “Admin, DomainAdmin, ResourceAdmin”.
– allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

How AI further empowers value stream management

12 Top ReactJS Development Companies in 2025

Not sure where to go with AI? Here’s your roadmap.

This week in AI dev tools: A2A donated to Linux Foundation, OpenAI adds Deep Research to API, and more (June 27, 2025)

The top 4 Bluetooth speakers I’m taking everywhere this summer (including a surprise pick)

Your Android phone is getting a big security upgrade for free – here’s what’s new

How a 5-minute circuit scan saved me hundreds (and exposed a serious wiring surprise)

Using AI saves teachers ‘six weeks per year,’ Gallup poll finds – but at what cost?

Say hello to ECMAScript 2025

Say hello to ECMAScript 2025

Ecma International approves ECMAScript 2025: What’s new?

Building Together: PRFT Colleagues Volunteer with Atlanta Habitat for Humanity

Fix Elden Ring Nightreign Connection Errors And Server Login Failure PC

Fix Elden Ring Nightreign Connection Errors And Server Login Failure PC

Fix Now EAC Error 20006 in Elden Ring: Nightreign [6 Easy Tricks]

Fix Now Elden Ring Nightreign EAC Error 30005 (CreateFile Failed)

CVE-2025-34045 – WeiPHP WeChat Public Account Path Traversal Vulnerability

New Linux Flaws Enable Full Root Access via PAM and Udisks Across Major Distributions

⚡ Weekly Recap: Chrome 0-Day, 7.3 Tbps DDoS, MFA Bypass Tricks, Banking Trojan and More

CVE-2025-6280 – TransformerOptimus SuperAGI EmailToolKit Path Traversal Vulnerability

How Vue Composables Work – Explained with Code Examples

CVE-2022-50227 – “KVM Xen Timer Initialization Vulnerability”

Smart Recommendation Engines: Driving Personalization & Sales in E-Commerce🛒

CVE-2025-47713 – Apache CloudStack Domain Admin Privilege Escalation Vulnerability

MongoDB 8.0, RBAC Now Available on DigitalOcean

Kritiek Veeam-lek laat aanvaller code op back-upserver uitvoeren

Veeam patches third critical RCE bug in Backup & Replication in space of a year

CVE-2025-34045 – WeiPHP WeChat Public Account Path Traversal Vulnerability

Related Posts