CVE-2025-12010

Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepts every connectivity check without cryptographically validating the STUN MESSAGE-INTEGRITY attribute. A network peer can forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path, enabling eavesdropping and media injection on unencrypted legs.

Prior to 1.11.2, FreeSWITCH's ws_read_frame() decodes a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrows the result into a signed length. A value whose surviving low word becomes negative bypasses the signed size check and is reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. This can corrupt connection pointers and crash FreeSWITCH, ending all concurrent sessions.

Prior to 1.11.3, FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left side as a chat protocol selector. Selecting the api chat proto reaches switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Exploitation has been observed in the wild.

Prior to 8.4.0, OpenEMR's controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path.

In SuiteCRM before 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. An authenticated user with the WorkFlow role can include executable PHP and achieve server-side code execution.

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands.

In SuiteCRM before 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account.

In OpenHuman before version 0.57.13, an attacker able to send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers.

In OpenHuman before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic AgentTurnRequest using the default tool policy without an interactive approval context. ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows node_exec to run despite the default Supervised policy requiring approval.

Cocos AI in version 0.8.2 and earlier accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. The vulnerability is addressed in 0.9.0, but cannot be patched in source code alone since it arises from the confidential computing threat model itself.