Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-23 | 3 | Disclosure2Patch1 |
| 2026-03-24 | 1 | Disclosure1 |
CVE-2025-60949: Remote attackers can access Census CSWeb configuration files via HTTP, risking sensitive data exposure. This critical vulnerability highlights the need for robust security measures in web systems. #CyberSecurity #InfoSec
Post summary
The post warns that CVE‑2025‑60949 allows remote attackers to retrieve Census CSWeb configuration files over HTTP, potentially exposing sensitive data.
🔴 CVE-2025-60949 - Critical Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secret... https://www.thehackerwire.com/vulnerability/CVE-2025-60949/ https://t.co/6yBJ49RXv8
Post summary
The post reveals a critical vulnerability (CVE-2025-60949) in Census CSWeb 8.0.1 that permits unauthenticated retrieval of sensitive configuration data via HTTP. It lacks any PoC, exploit code, active exploitation report, or patch information.
[CVE-2025-60949: CRITICAL] Vulnerable Census CSWeb 8.0.1 allows access to configuration files over HTTP, potentially exposing secrets. Update to secure version 8.1.0 alpha to fix this issue.#cve,CVE-2025-60949,#cybersecurity https://cvefind.com/CVE-2025-60949
Post summary
The tweet discloses a critical vulnerability in Census CSWeb 8.0.1 that permits unauthorized access to configuration files over HTTP and recommends upgrading to 8.1.0 alpha to remediate it.
🚨 CVE-2025-60949: Census CSWeb leaked configuratio... Direct path traversal to `/app/config` exposes database creds, API keys, and session secrets—zero-auth required, CVSS 9... https://zerodaysignal.com/vulnerability/CVE-2025-60949 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2025-60949 is a path traversal vulnerability exposing database credentials, API keys, and session secrets with zero authentication, and a high CVSS score; no PoC, exploit tool, or active exploitation evidence is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | csprousers | csweb | 8.0.1 | - | - |