CVE-2023-25261

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.

• CWE-94

• https://cloud-trustit.spp.at/s/Rskwb3jKXQQsJy2Broken Link
• https://cves.at/posts/cve-2023-25261/writeup/Third Party Advisory
• https://cloud-trustit.spp.at/s/Rskwb3jKXQQsJy2Broken Link
• https://cves.at/posts/cve-2023-25261/writeup/Third Party Advisory

Published

Mar 27, 2023

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25235Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow …7.5
• CVE-2023-2524A vulnerability classified as critical has been found in Con…9.8
• CVE-2023-25240An improper SameSite Attribute vulnerability in pimCore v10.…8.8
• CVE-2023-25241bgERP v22.31 was discovered to contain a reflected cross-sit…6.1
• CVE-2023-2526The Easy Google Maps plugin for WordPress is vulnerable to C…5.4
• CVE-2023-25260Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local Fi…7.5
• CVE-2023-25262Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulner…7.5
• CVE-2023-25263In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, onc…5.5
• CVE-2023-25264An issue was discovered in Docmosis Tornado prior to version…7.5
• CVE-2023-25265Docmosis Tornado <= 2.9.4 is vulnerable to Directory Travers…7.5
• CVE-2023-25266An issue was discovered in Docmosis Tornado prior to version…8.8
• CVE-2023-25267An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (…8.8