CVE-2022-25026

CVE-2022-25026 is a Server-Side Request Forgery in Rocket TRUfusion Portal v7.9.2.1. An attacker can trigger requests to /trufusionPortal/upDwModuleProxy to access internal resources. CVSS v3.1 base score 7.5 (HIGH); vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No exploitation details or remediati...

CVE-2022-25027

The CVE-2022-25027 entry concerns Rocket TRUfusion Portal v7.9.2.1, where the Forgotten Password flow can bypass authentication by validating the user’s session token after clicking the Password forgotten?; this is described across multiple sources (NVD, Red Hat CVE entries, OSV) as an authentica...

CVE-2025-32355

Rocket TRUfusion Enterprise (versions through 7.10.4.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a misconfigured reverse proxy that handles incoming connections, allowing an attacker to specify absolute URLs within the HTTP request line. This causes the proxy ...

CVE-2025-27222

TRUfusion Enterprise versions up to and including 7.10.4.0 are vulnerable to a pre-auth path traversal vulnerability in the /trufusionPortal/getCobrandingData endpoint. The root cause is insufficient input sanitization, which allows attackers to include path traversal sequences to read arbitrary ...

CVE-2025-27225

TRUfusion Enterprise versions 7.10.4.0 and earlier are vulnerable to a security flaw where the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint is exposed to unauthenticated users. This vulnerability allows attackers to access the Internal Admin Contact Page without authorization, l...

CVE-2025-59793

Rocket TRUfusion Enterprise versions through 7.10.5 are vulnerable to a path traversal flaw in the WsPortalV6UpDwAxis2Impl service, specifically via the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint. The application fails to properly sanitize the jobDirectory parameter, allowing authenticated ...

CVE-2025-27223

TRUfusion Enterprise versions through 7.10.4.0 are vulnerable to an authentication bypass due to a hard-coded cryptographic key used to create encrypted cookies. This flaw allows attackers to forge session cookies and gain unauthorized access to sensitive internal information, specifically affect...

CVE-2025-27224

TRUfusion Enterprise versions through 7.10.4.0 are vulnerable to a critical flaw in the /trufusionPortal/fileupload endpoint. Due to improper input validation , an attacker can include path traversal sequences to write files of any name or type to arbitrary locations on the local server. This vul...