Overview A critical security vulnerability, identified as CVE-2025-64741, has been discovered in Zoom Workplace for Android. This vulnerability allows an unauthenticated attacker with network access to escalate their privileges, potentially gaining unauthorized control within the application. The vulnerability affects versions prior to 6.5.10. Technical Details CVE-2025-64741 stems from improper authorization handling within the Zoom Workplace application for Android. Specifically, the application fails to adequately verify the permissions of incoming network requests. This lack of proper authentication and authorization allows a malicious actor to craft network requests that bypass security checks and grant elevated privileges. While the exact attack vector will…

Overview CVE-2025-64739 is a medium severity vulnerability affecting certain Zoom Clients. This vulnerability allows an unauthenticated attacker with network access to potentially disclose sensitive information by manipulating file names or paths. The vulnerability stems from improper handling of external input related to file operations within the affected Zoom Clients. Technical Details The root cause of CVE-2025-64739 lies in the Zoom Client’s susceptibility to external control of file names or paths. Specifically, an unauthenticated attacker could potentially craft malicious network requests that influence how the Zoom Client handles file operations (e.g., logging, temporary file creation). By manipulating these file names or…

Overview CVE-2025-64738 is a medium severity vulnerability affecting Zoom Workplace for macOS versions prior to 6.5.10. This vulnerability stems from insufficient validation of file names or paths, potentially allowing an authenticated local user to exploit the system and gain access to sensitive information. This is achieved through external control of the file name or path, leading to unintended file access. Technical Details The vulnerability lies in the way Zoom Workplace for macOS handles file paths and names during specific operations. An attacker with local access and valid Zoom credentials can manipulate the expected file name or path used by the…

Overview CVE-2025-62483 is a medium severity vulnerability affecting certain Zoom Clients before version 6.5.10. This vulnerability stems from the improper removal of sensitive information, potentially allowing an unauthenticated attacker with network access to disclose sensitive data. It’s crucial to understand the impact and take necessary steps to mitigate this risk. Technical Details The vulnerability lies in the way Zoom clients handle sensitive information during certain operations. Specifically, prior to version 6.5.10, the client does not adequately scrub or remove sensitive data from memory or temporary storage before or after the operation is complete. An attacker who can intercept network traffic…

Overview CVE-2025-62482 is a medium-severity cross-site scripting (XSS) vulnerability affecting Zoom Workplace for Windows versions before 6.5.10. This flaw could allow an unauthenticated attacker with network access to inject malicious scripts, potentially impacting the integrity of the application and user data. Technical Details The vulnerability stems from insufficient input sanitization within Zoom Workplace for Windows. Specifically, a network-accessible endpoint lacks proper validation, allowing an attacker to inject arbitrary JavaScript code. By crafting a malicious request, an unauthenticated attacker could potentially execute scripts within the context of the Zoom application, leading to various security risks. CVSS Analysis CVSS Score: 4.3 Vector:…

Overview CVE-2025-30669 is a security vulnerability affecting certain Zoom Clients. Discovered and published on November 13, 2025, this flaw stems from improper certificate validation, potentially allowing an unauthenticated attacker with adjacent network access to conduct information disclosure. The severity is rated as MEDIUM, with a CVSS score of 4.8. Technical Details The vulnerability lies in how specific versions of the Zoom Client handle certificate validation. Due to insufficient checks, an attacker positioned on the same network (adjacent access) could potentially exploit this weakness to intercept or manipulate network traffic, leading to the disclosure of sensitive information. This is possible because…

Overview CVE-2025-30662 describes a medium severity vulnerability affecting the Zoom Workplace VDI Plugin macOS Universal installer. Specifically, a symlink following vulnerability exists in versions prior to 6.3.14, 6.4.14, and 6.5.10 of their respective tracks. This vulnerability could allow an authenticated local user to potentially conduct information disclosure via network access. Technical Details The vulnerability stems from the installer’s handling of symbolic links (symlinks). An authenticated user, with local access to the system, can potentially manipulate the installer process by creating malicious symlinks. These symlinks could point to sensitive files outside of the intended installation directory. When the installer attempts to…

Overview CVE-2025-13119 describes a Cross-Site Request Forgery (CSRF) vulnerability found in Fabian Ros/SourceCodester Simple E-Banking System version 1.0. This flaw allows a remote attacker to potentially execute unauthorized actions on behalf of legitimate users, such as initiating forced withdrawals, if they can trick a user into clicking a malicious link or visiting a compromised website. The vulnerability has been published and an exploit is available, making it a significant security concern for deployments of this system. Technical Details The vulnerability resides in an unspecified part of the Simple E-Banking System 1.0. By crafting a malicious HTTP request that exploits the…

Overview CVE-2025-41069 is a security vulnerability identified in DeporSite, a product by T-INNOVA. This vulnerability is classified as an Insecure Direct Object Reference (IDOR). IDOR vulnerabilities occur when an application allows direct access to internal implementation objects based on user-supplied input. This can lead to unauthorized data access or modification. Technical Details The vulnerability exists in the /ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos endpoint of the DeporSite application. An attacker can exploit this IDOR by manipulating the idUsuario parameter in the request. By changing the value of this parameter, an attacker can potentially access or modify the consent form data associated with other users, without…

Overview CVE-2025-13116 is a medium-severity vulnerability affecting macrozheng’s mall-swarm, specifically versions up to 1.0.3. This vulnerability resides in the cancelUserOrder function located in the /order/cancelUserOrder endpoint. An attacker can exploit this flaw by manipulating the orderId parameter, leading to improper authorization and potentially allowing the cancellation of orders belonging to other users. A proof-of-concept exploit is publicly available, increasing the risk of active exploitation. The vendor was notified but did not respond. Published: 2025-11-13T14:15:48.550 Technical Details The vulnerability stems from insufficient validation and authorization checks within the cancelUserOrder function. By altering the orderId parameter in the request, an attacker can…