CVE-2025-41737
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Due to webserver misconfiguration, an unauthenticated remote attacker is able to read the source of PHP modules.
Risk Assessment
Disclosure of PHP module source code may help an attacker understand application logic and find further vulnerabilities.
Recommendation
Fix the webserver configuration to prevent access to PHP source files and review the configuration for similar issues.
Other vulnerabilities in Web server
See all- CVE-2026-70381Medium
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
- CVE-2025-9177High
A denial-of-service security issue exists in the affected product and version, stemming from a high number of requests sent to the web server. This can cause a web server crash but does not impact I/O control or communication; a power cycle is required to recover the webpage.
Original NVD description (English source)
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS