CVE-2025-32440

critical · 10

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within util.php by sending crafted requests to /index.php. This issue has been patched in version 25.4.14.

CVSS

0.6%

EPSS (exploit prob.)

46th

EPSS percentile

2025-05-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
netalertx	netalertx	< 25.4.14

Check a specific version with /api/v1/cve/match.

References

https://github.com/jokob-sk/NetAlertX/releases/tag/v25.4.14
https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx
https://github.com/jokob-sk/NetAlertX/security/advisories/GHSA-h4x5-vr54-vjrx

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-32440