Asseco
Monthly
XML External Entity processing in proCertum SmartSign allows server-side request forgery (SSRF) and local file disclosure via crafted signature files. The vulnerability is triggered when a victim merely previews a malicious file in the file selection window, before clicking Open. patched in version 9.4.3.90. No active exploitation or public exploit code identified.
We are tasked with synthesizing data about CVE-2026-57916 into a comprehensive analysis. We must follow all rules strictly. First, gather data from the input: - CVE ID: CVE-2026-57916 - Description: proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90. - CVSS Score: 4.6 - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - CWE: CWE-73 External Control of File Name or Path - Reported by: CERT-PL - CPE: cpe:2.3:a:asseco:procertum_smartsign:*:*:*:*:*:*:*:* - Tags: Information Disclosure, Procertum Smartsign (likely a typo, should be proCertum SmartSign) - References: - cert.pl/posts/2026/07/CVE-2026-57916 - pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/ Now, we have to synthesize. Note: There is no KEV status, no EPSS, no POC mention. So we'll use standard phrases. Let's construct each field. product_name: "proCertum SmartSign" - the specific product. Use 1-3 words. summary: Need to start with impact verb and product. "proCertum SmartSign allows arbitrary file execution via CPS URI due to missing schema validation." Possible summary: "proCertum SmartSign before 9.4.3.90 fails to validate the schema of Certificate Practice Statement (CPS) URIs, allowing a document recipient to be tricked into executing a local executable or opening a malicious webpage when viewing a specially crafted signed document. No authentication required; user interaction is needed to open the document." The attack vector is local? CVSS says AV:L, meaning local, but description suggests sending document to victim, so the execution occurs when victim opens it. The CVSS 4.0 has UI:A (Active), meaning
CVE-2025-66955 is a security vulnerability (CVSS 6.5) that allows remote authenticated users. Remediation should follow standard vulnerability management procedures.
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XML External Entity processing in proCertum SmartSign allows server-side request forgery (SSRF) and local file disclosure via crafted signature files. The vulnerability is triggered when a victim merely previews a malicious file in the file selection window, before clicking Open. patched in version 9.4.3.90. No active exploitation or public exploit code identified.
We are tasked with synthesizing data about CVE-2026-57916 into a comprehensive analysis. We must follow all rules strictly. First, gather data from the input: - CVE ID: CVE-2026-57916 - Description: proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90. - CVSS Score: 4.6 - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N - CWE: CWE-73 External Control of File Name or Path - Reported by: CERT-PL - CPE: cpe:2.3:a:asseco:procertum_smartsign:*:*:*:*:*:*:*:* - Tags: Information Disclosure, Procertum Smartsign (likely a typo, should be proCertum SmartSign) - References: - cert.pl/posts/2026/07/CVE-2026-57916 - pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/ Now, we have to synthesize. Note: There is no KEV status, no EPSS, no POC mention. So we'll use standard phrases. Let's construct each field. product_name: "proCertum SmartSign" - the specific product. Use 1-3 words. summary: Need to start with impact verb and product. "proCertum SmartSign allows arbitrary file execution via CPS URI due to missing schema validation." Possible summary: "proCertum SmartSign before 9.4.3.90 fails to validate the schema of Certificate Practice Statement (CPS) URIs, allowing a document recipient to be tricked into executing a local executable or opening a malicious webpage when viewing a specially crafted signed document. No authentication required; user interaction is needed to open the document." The attack vector is local? CVSS says AV:L, meaning local, but description suggests sending document to victim, so the execution occurs when victim opens it. The CVSS 4.0 has UI:A (Active), meaning
CVE-2025-66955 is a security vulnerability (CVSS 6.5) that allows remote authenticated users. Remediation should follow standard vulnerability management procedures.
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.