4Pace

CVE-2025-25905 Jun 25, 16:15 HIGH POC This Week

CVE-2025-25905 is a Reflected Cross-Site Scripting (XSS) vulnerability in CADClick versions 1.13.0 and earlier that allows unauthenticated remote attackers to inject arbitrary HTML and JavaScript through the 'tree' parameter. Successful exploitation requires user interaction (clicking a malicious link) but can lead to session hijacking, credential theft, and defacement. The vulnerability has a CVSS score of 7.1 (high severity) with a moderate attack complexity, indicating it is practically exploitable in real-world scenarios.

CVE-2024-41516 Oct 04, 18:15 MEDIUM POC This Month

A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-41515 Oct 04, 18:15 MEDIUM POC This Month

A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "res_url" parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-41514 Oct 04, 18:15 MEDIUM POC This Month

A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-41513 Oct 04, 18:15 MEDIUM POC This Month

A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-41512 Oct 04, 18:15 HIGH POC This Week

A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-41511 Oct 04, 18:15 LOW POC Monitor

A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.