CVE-2025-43923

CVE-2025-43923 affects Unicom Focal Point 7.6.1 in the ReportController. The issue allows a user with administrative privileges to perform a SQL injection via the image parameter during a delete report image operation. The CVSS metrics indicate a network-accessible issue with low confidentiality ...

CVE-2025-43925

CVE-2025-43925 affects Unicom Focal Point 7.6.1. The issue is that the database is encrypted with a hardcoded key, which could allow recovery of plaintext data. Multiple connected sources corroborate the vulnerability, noting the same root cause and potential impact. There is no explicit exploit ...

CVE-2025-43924

CVE-2025-43924 affects Unicom Focal Point 7.6.1. The stored XSS vulnerability arises from unsanitized input in two admin endpoints: val in SettingController (/fp/admin/settings/loginpage) and rootserviceurl in FriendsController (/fp/admin/settings/friends). Exploitation premise: an admin-entered ...