CVE-2025-2977
Last modified
CVE-2025-2977 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gfi | Kerio Connect | 10.0.6 |
References
- https://vuldb.com/?ctiid.302029Permissions Required, VDB Entry
- https://vuldb.com/?id.302029Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.523016Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-2977?
How severe is CVE-2025-2977?
How do I fix CVE-2025-2977?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-29757An incorrect authorisation check in the the 'plant transfer'…9.4
- CVE-2025-2976A vulnerability was found in GFI KerioConnect 10.0.6. It has…5.4
- CVE-2025-29763Rejected reason: “This CVE ID is Rejected and will not be us…
- CVE-2025-29766Tuleap is an Open Source Suite to improve management of soft…4.3
- CVE-2025-29768Vim, a text editor, is vulnerable to potential data loss wit…4.4
- CVE-2025-29769libvips is a demand-driven, horizontally threaded image proc…5.5
- CVE-2025-29770vLLM is a high-throughput and memory-efficient inference and…6.5
- CVE-2025-29771HtmlSanitizer is a client-side HTML Sanitizer. Versions prio…5.3
- CVE-2025-29772OpenEMR is a free and open source electronic health records …6.1
- CVE-2025-29773Froxlor is open-source server administration software. A vul…7.8
- CVE-2025-29774xml-crypto is an XML digital signature and encryption librar…9.3
- CVE-2025-29775xml-crypto is an XML digital signature and encryption librar…9.3
Are you affected by CVE-2025-2977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST