Nov 05, 2025Ravie LakshmananVulnerability / Community Safety
The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Tuesday added two safety flaws impacting Gladinet and Management Net Panel (CWP) to its Recognized Exploited Vulnerabilities (KEV) catalog, citing proof of energetic exploitation within the wild.
The vulnerabilities in query are listed under –
CVE-2025-11371 (CVSS rating: 7.5) – A vulnerability in recordsdata or directories accessible to exterior events in Gladinet CentreStack and Triofox that might end in unintended disclosure of system recordsdata.
CVE-2025-48703 (CVSS rating: 9.0) – An working system command injection vulnerability in Management Net Panel (previously CentOS Net Panel) that leads to unauthenticated distant code execution by way of shell metacharacters within the t_total parameter in a filemanager changePerm request.
The event comes weeks after cybersecurity firm Huntress mentioned it detected energetic exploitation makes an attempt focusing on CVE-2025-11371, with unknown menace actors leveraging the flaw to run reconnaissance instructions (e.g., ipconfig /all) handed within the type of a Base64-encoded payload.
Nonetheless, there are at present no public reviews on how CVE-2025-48703 is being weaponized in real-world assaults. Nonetheless, technical particulars of the flaw had been shared by safety researcher Maxime Rinaudo in June 2025, shortly after it was patched in model 0.9.8.1205 following accountable disclosure on Could 13.
“It permits a distant attacker who is aware of a legitimate username on a CWP occasion to execute pre-authenticated arbitrary instructions on the server,” Rinaudo mentioned.
In mild of energetic exploitation, Federal Civilian Govt Department (FCEB) companies are required to use the mandatory fixes by November 25, 2025, to safe their networks.
The addition of the 2 flaws to the KEV catalog follows reviews from Wordfence in regards to the exploitation of crucial safety vulnerabilities impacting three WordPress plugins and themes –
CVE-2025-11533 (CVSS rating: 9.8) – A privilege escalation vulnerability in WP Freeio that makes it attainable for an unauthenticated attacker to grant themselves administrative privileges by specifying a person position throughout registration.
CVE-2025-5397 (CVSS rating: 9.8) – An authentication bypass vulnerability in Noo JobMonster that makes it attainable for unauthenticated attackers to sidestep customary authentication and entry administrative person accounts, assuming social login is enabled on a web site.
CVE-2025-11833 (CVSS rating: 9.8) – An absence of authorization checks in Publish SMTP that makes it attainable for an unauthenticated attacker to view electronic mail logs, together with password reset emails, and alter the password of any person, together with an administrator, permitting web site takeover.
WordPress web site customers counting on the aforementioned plugins and themes are really useful to replace them to the newest model as quickly as attainable, use sturdy passwords, and audit the websites for indicators of malware or the presence of sudden accounts.
