CVE-2025-1741

A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched remotely. Upgrading to version 7.4.1-pl2 is able to address this issue. The identifier of the patch is 4816c8b748f6a5b965c8994e2cf10861bf6e68aa. It is recommended to upgrade the affected component. The vendor acted highly professional and even fixed this issue in the discontinued commercial edition as b1gMail 7.4.0-pl3.

• CWE-20
• CWE-502

• https://gist.github.com/mcdruid/cb0b848c12fd6a6bc0c1b3357b983d30
• https://github.com/b1gMail-OSS/b1gMail/commit/4816c8b748f6a5b965c8994e2cf10861bf6e68aa
• https://github.com/b1gMail-OSS/b1gMail/releases/tag/7.4.1-pl2
• https://vuldb.com/?ctiid.297829
• https://vuldb.com/?id.297829
• https://vuldb.com/?submit.505838
• https://www.b1gmail.eu/forum/thread/217-security-update-to-b1gmail-7-4-1-released/

Published

Feb 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1735In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.…7.5
• CVE-2025-1736In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f…7.3
• CVE-2025-1737Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-1738A Password Transmitted over Query String vulnerability has b…6.2
• CVE-2025-1739An Authentication Bypass vulnerability has been found in Tri…7.1
• CVE-2025-1740Improper Restriction of Excessive Authentication Attempts vu…9.8
• CVE-2025-1742A vulnerability, which was classified as problematic, has be…6.1
• CVE-2025-1743A vulnerability, which was classified as critical, was found…6.9
• CVE-2025-1744Out-of-bounds Write vulnerability in radareorg radare2 allow…9.8
• CVE-2025-1745A vulnerability has been found in LinZhaoguan pb-cms 2.0 and…5.3
• CVE-2025-1746Cross-Site Scripting vulnerability in OpenCart versions prio…6.1
• CVE-2025-1747HTML injection vulnerabilities in OpenCart versions prior to…4.7