CVE-2025-56218

CVE-2025-56218 无限制文件上传 描述 攻击者可以上传一个包含恶意脚本或钓鱼 URL 的 Excel 文件。应用程序将该文件转换为 PDF 并转发给预期收件人进行数字签名。由于生成的 PDF 中的超链接以攻击者控制的文本显示，且没有显示任何警告，收件人可能会被欺骗点击该链接，从而触发恶意命令的执行 CVSS 评分：5.5（中危） 攻击类型 远程（已认证） 受影响版本 8.6.8 及之前的版本 产品供应商 Ascertia 受影响产品代码库 SigningHub 受影响组件 文件上传功能。 缓解措施 在将上传的文件发送给目标用户之前对其进行扫描 漏洞详情...

CVE-2025-54321

CVE-2025-54321 Reset Password Email Bombing Description The reset password function does not implement rate limiting for the target email address. This allows for an Email Bombing attack CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discoverer Yazan...

CVE-2025-54320

CVE-2025-54320 Invite User Email Bombing Description The invitation API does not implement rate limiting for the target email address. This allows for an Email Bombing attack. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Na...

CVE-2025-56219

CVE-2025-56219 缺少速率限制 – 添加用户 API 描述 攻击者可以在短时间内自动创建大量用户，从而造成拒绝服务（DoS）。 CVSS 评分：7.1（高危） 攻击类型 远程（已认证） 受影响版本 8.6.8 及之前的版本 产品供应商 Ascertia 受影响产品代码库 SigningHub 受影响组件 添加用户 API。 缓解措施 为添加用户 API 实施速率限制。 漏洞详情 该应用程序允许用户添加新用户账户，且没有任何速率限制或节流机制。此缺陷使攻击者能够在短时间内自动创建大量用户账户，可能导致资源耗尽、数据库膨胀或拒绝服务（DoS）。 已修复版本 8.6.8 之后的版本...

CVE-2025-56224

CVE-2025-56224（OTP）验证绕过 描述 攻击者可以冒充其他用户的手机号码，并利用此漏洞在不知道 OTP 验证码的情况下验证该号码。 CVSS 评分：8.1（高危） 攻击类型 远程（已认证） 受影响版本 8.6.8 及之前的版本 产品供应商 Ascertia 受影响产品代码库 SigningHub 受影响组件 手机号码验证功能。 缓解措施 如果尝试次数超过一定值，则撤销 OTP 验证码。 漏洞详情 该应用程序未对一次性密码（OTP）验证端点实施适当的速率限制。这允许攻击者在不受限制的情况下自动化并暴力破解 OTP 验证码。通过快速连续发送大量 OTP...

CVE-2025-56221

CVE-2025-56221 对过多身份验证尝试的限制不当 描述 攻击者可以进行无限制的身份验证尝试，从而增加通过密码猜测来入侵目标用户账户的风险。 CVSS 评分：7.5（高危） 攻击类型 远程（已认证） 受影响版本 版本 8.6.8 发现者： Yazan Abu-Nadi...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

EUVD-2025-209233

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

PT-2026-30683

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

Ascertia SigningHub 安全漏洞

Ascertia SigningHub is an electronic signature software developed by the British company Ascertia. Version 10.0 of Ascertia SigningHub contains a security vulnerability. This vulnerability stems from open redirection, allowing attackers to redirect users to malicious websites through a specially...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2025-61166

The CVE-2025-61166 entry describes an open redirect in Ascertia SigningHub User v10.0 that lets an attacker redirect authenticated users to a malicious site via a crafted URL. Affected product: Ascertia SigningHub User 10.0 (component: open redirect functionality). Root cause: misimplementation o...

EUVD-2025-198073

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...

CVE-2025-54321

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...

CVE-2025-54321

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests...

CVE-2025-54320

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...

CVE-2025-54320

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests...

CVE-2025-54320

In Ascertia SigningHub up to version 8.6.8, the Invite Users function lacks rate limiting, enabling an authenticated attacker to automate invites and trigger an email bombing scenario. Affected software: Ascertia SigningHub (versions through 8.6.8). Underlying issue: insufficient throttling on th...

Ascertia SigningHub 安全漏洞

Ascertia SigningHub is an electronic signature software from Ascertia UK. A security vulnerability exists in Ascertia SigningHub version 8.6.8 and prior versions, which stems from a lack of rate limiting in the reset password function and could lead to email bombing...