CVE-2025-26138

Systemic Risk Value (versions 2.8.0 and prior ) is vulnerable to improper access control within the GetFile component at the /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID= endpoint. The root cause is the use of a predictable numerical ID parameter to access uploaded files. This allows unau...

CVE-2025-26137

The Systemic RiskValue tool, developed by Systemic, Inc. , is vulnerable to Local File Inclusion (LFI) in versions 2.8.0 and earlier . The flaw exists within the GetFile component via the /GetFile.aspx?ReportUrl= endpoint. An unauthenticated attacker can exploit this by providing a crafted file p...